1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b

General

Target

1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe
Size

4.1MB
MD5

c554f5bc12ea046ad9722ff24ce5bb0f
SHA1

e729d5931f379aab9c9949732ddb43107270899a
SHA256

1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b
SHA512

6398d6a4ea0d94772097a12fe6de12d23b49453c2b1285d4342be4f4b7b39bef8df3132e65b20f73159bc67880ceccde2f98ba700ebd40d13dc68610e9429e11
SSDEEP

98304:sZUg5LFvJOTI6UPap4L9NpOlnlwtHTKrvATuE:25SInk4L9jglwtz2ATuE

Score

8^/10

vmprotect

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

game.exe

pid process

1692 game.exe

pid	process
1692	game.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\game.exe	vmprotect
\Users\Admin\AppData\Local\Temp\game.exe	vmprotect
\Users\Admin\AppData\Local\Temp\game.exe	vmprotect
\Users\Admin\AppData\Local\Temp\game.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\game.exe	vmprotect
behavioral1/memory/1692-62-0x0000000000400000-0x0000000004FEE000-memory.dmp	vmprotect

Loads dropped DLL 4 IoCs

Processes:

1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe

pid	process
1088	1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe
1088	1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe
1088	1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe
1088	1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe

description	pid	process	target process
PID 1088 wrote to memory of 1692	1088	1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe	game.exe
PID 1088 wrote to memory of 1692	1088	1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe	game.exe
PID 1088 wrote to memory of 1692	1088	1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe	game.exe
PID 1088 wrote to memory of 1692	1088	1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe	game.exe
PID 1088 wrote to memory of 1692	1088	1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe	game.exe
PID 1088 wrote to memory of 1692	1088	1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe	game.exe
PID 1088 wrote to memory of 1692	1088	1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe	game.exe

C:\Users\Admin\AppData\Local\Temp\1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe
"C:\Users\Admin\AppData\Local\Temp\1bda31487ac5e04d007f0e2268a19544de8ede84df20008be1185c0034b1119b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Local\Temp\game.exe
"C:\Users\Admin\AppData\Local\Temp\game.exe"
2⤵
- Executes dropped EXE
PID:1692

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\game.exe
Filesize
1.8MB

MD5
fa83d865f371b5a64faa264a10cc979e

SHA1
eb2d288ecfc3be8a36ab2412c4d3c14bbabd0fcb

SHA256
35a8876085092daa949be4417aaa805f574bb104c739cd15a2370e87b0042626

SHA512
503493705aa22d1d6fde915805bba1eafc7808a6b881ac7945df00525a1d04a5a0256e8476f1503c48158e7809ebe1d90f0e7a99da2766e2887ac54d6cfa177f

Download Submit
\Users\Admin\AppData\Local\Temp\game.exe
Filesize
1.8MB

MD5
fa83d865f371b5a64faa264a10cc979e

SHA1
eb2d288ecfc3be8a36ab2412c4d3c14bbabd0fcb

SHA256
35a8876085092daa949be4417aaa805f574bb104c739cd15a2370e87b0042626

SHA512
503493705aa22d1d6fde915805bba1eafc7808a6b881ac7945df00525a1d04a5a0256e8476f1503c48158e7809ebe1d90f0e7a99da2766e2887ac54d6cfa177f

Download Submit
\Users\Admin\AppData\Local\Temp\game.exe
Filesize
1.8MB

MD5
fa83d865f371b5a64faa264a10cc979e

SHA1
eb2d288ecfc3be8a36ab2412c4d3c14bbabd0fcb

SHA256
35a8876085092daa949be4417aaa805f574bb104c739cd15a2370e87b0042626

SHA512
503493705aa22d1d6fde915805bba1eafc7808a6b881ac7945df00525a1d04a5a0256e8476f1503c48158e7809ebe1d90f0e7a99da2766e2887ac54d6cfa177f

Download Submit
\Users\Admin\AppData\Local\Temp\game.exe
Filesize
1.8MB

MD5
fa83d865f371b5a64faa264a10cc979e

SHA1
eb2d288ecfc3be8a36ab2412c4d3c14bbabd0fcb

SHA256
35a8876085092daa949be4417aaa805f574bb104c739cd15a2370e87b0042626

SHA512
503493705aa22d1d6fde915805bba1eafc7808a6b881ac7945df00525a1d04a5a0256e8476f1503c48158e7809ebe1d90f0e7a99da2766e2887ac54d6cfa177f

Download Submit
\Users\Admin\AppData\Local\Temp\game.exe
Filesize
1.8MB

MD5
fa83d865f371b5a64faa264a10cc979e

SHA1
eb2d288ecfc3be8a36ab2412c4d3c14bbabd0fcb

SHA256
35a8876085092daa949be4417aaa805f574bb104c739cd15a2370e87b0042626

SHA512
503493705aa22d1d6fde915805bba1eafc7808a6b881ac7945df00525a1d04a5a0256e8476f1503c48158e7809ebe1d90f0e7a99da2766e2887ac54d6cfa177f

Download Submit
memory/1088-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1692-59-0x0000000000000000-mapping.dmp

Download
memory/1692-62-0x0000000000400000-0x0000000004FEE000-memory.dmp

Filesize
75.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads