840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067

General

Target

840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
Size

207KB
MD5

da990c92650cc9d76ec7551b83bf0b80
SHA1

35ea8708c240cd12d5e3dc275eef6434241bf4c9
SHA256

840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067
SHA512

78cd07c66bf5ef3086bd5daee5730e1434481947588f4717b3b35900e9b67842a47df42d078377387d4f71a5c89acd80f3a4a0630239e897858bc76325b719c8
SSDEEP

6144:NK7kA352xsl1hssGwGWlatbJ6GV+3/DVvWtU1k:2kAJ2xifBwFCNt

Score

8^/10

vmprotect

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

Processes:

840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\wmiacpi.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\fdc.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\iagpio.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\processr.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\system32\drivers\ucx01000.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\sfloppy.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\Drivers\UcmTcpciCx.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\vstxraid.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\xboxgip.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\circlass.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\mausbip.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\ndfltr.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\rassstp.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\BthEnum.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\system32\drivers\ndisuio.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\iaLPSS2i_GPIO2_GLK.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\ibbus.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\usbprint.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\MSKSSRV.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\parport.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\cht4sx64.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\CmBatt.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\dmvsc.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\hidspi.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\amdxata.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\bcmfn2.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\iaStorAVC.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\MSTEE.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\lsi_sas.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\megasas35i.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\percsas3i.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\usbcir.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\percsas2i.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\pnpmem.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\SDFRd.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\lsi_sas3i.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\system32\drivers\Acx01000.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\bttflt.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\iaLPSS2i_GPIO2_CNL.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\iaLPSSi_GPIO.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\Drivers\UcmCx.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\system32\drivers\appid.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\drmkaud.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\mvumis.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\rhproxy.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\hidbth.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\vwifibus.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\usbaudio2.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\winmad.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\ADP80XX.SYS	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\nvstor.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\Synth3dVsc.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\uaspstor.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\3ware.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\serenum.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\UsbHub3.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\nvdimm.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\DRIVERS\rasacd.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\system32\drivers\WdmCompanionFilter.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\IPMIDrv.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\DRIVERS\ndistapi.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\ufxsynopsys.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\buttonconverter.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\drivers\scmbus.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/2952-132-0x0000000000400000-0x0000000000468000-memory.dmp	vmprotect
behavioral2/memory/2952-133-0x0000000000400000-0x0000000000468000-memory.dmp	vmprotect
behavioral2/memory/2952-135-0x0000000000400000-0x0000000000468000-memory.dmp	vmprotect

Drops file in System32 directory 6 IoCs

Processes:

840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\urssynopsys.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\genericusbfn.inf_amd64_53931f0ae21d6d2c\genericusbfn.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\UEFI.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ufxchipidea.inf_amd64_1c78775fffab6a0a\UfxChipidea.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\urschipidea.sys	840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe

C:\Users\Admin\AppData\Local\Temp\840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
"C:\Users\Admin\AppData\Local\Temp\840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-132-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2952-133-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2952-135-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads