d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c

Analysis

max time kernel
186s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 01:43

Target

d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
Size

95KB
MD5

deb6eacef0a8347451df11ab8b3f60c1
SHA1

6d32f61a0aa794a0c0ac77504fec458eb1abc4b8
SHA256

d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c
SHA512

6afc2b318166951566f2e330e06fc19a6b5df056a997d62147a7794d2f31df40a68181b44e40ef7dfcc426601007b37e647e3db009dbeb65a09ff58e0428248b
SSDEEP

1536:ivQbT1ceTu9hqY823riQqmGNkyYjdR633o2QOtHckyJikTX3MnKeDpgp94cuo4R:iKhGqr23riTHNadRw3o2QRJikTHM562U

Score

8^/10

upx vmprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4496-132-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4496-136-0x0000000000400000-0x000000000041F000-memory.dmp	upx

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/files/0x0006000000022e16-133.dat	vmprotect
behavioral2/files/0x0006000000022e16-134.dat	vmprotect

Loads dropped DLL 2 IoCs

pid	Process
4496	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
4496	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\zlerjb3.dat	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
File opened for modification	C:\Windows\SysWOW64\zlerjb4.dat	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
File created	C:\Windows\SysWOW64\zlerjb5.dat	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
File created	C:\Windows\SysWOW64\zlerjb1.dat	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
File opened for modification	C:\Windows\SysWOW64\zlerjb2.dat	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
File created	C:\Windows\SysWOW64\zlerjb2.dat	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
File opened for modification	C:\Windows\SysWOW64\zlerjb5.dat	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
File opened for modification	C:\Windows\SysWOW64\zlerjb1.dat	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
File created	C:\Windows\SysWOW64\zlerjb3.dat	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
File created	C:\Windows\SysWOW64\zlerjb4.dat	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\jvodskvm\lkoxytotg.dll	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4496	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
4496	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe

Suspicious behavior: LoadsDriver 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4496	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
Token: SeLoadDriverPrivilege	4496	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4496	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 1380	4496	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe	79
PID 4496 wrote to memory of 1380	4496	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe	79
PID 4496 wrote to memory of 1380	4496	d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe	79

C:\Users\Admin\AppData\Local\Temp\d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
"C:\Users\Admin\AppData\Local\Temp\d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\D98BDF~1.EXE
  2⤵
  PID:1380

C:\Program Files\jvodskvm\lkoxytotg.dll

Filesize
93KB

MD5
ee0ed1e2d452c31965d3875c9b14de71

SHA1
7092e40a68001e7202024c32119970d5175ed027

SHA256
caea75f95fe6ffc81e5574b03f5fb440edf20b400a5937a9d46df323761357f6

SHA512
86c941b97392617a728a9f29ce0da4d8410b1bc92d47cc733f514054c8e46b7a22e8c59c9c3df81d92e3926b371fa17be841b60ceeb68b0c3aa47583b4920a4d

Download Submit
C:\Program Files\jvodskvm\lkoxytotg.dll

Filesize
93KB

MD5
ee0ed1e2d452c31965d3875c9b14de71

SHA1
7092e40a68001e7202024c32119970d5175ed027

SHA256
caea75f95fe6ffc81e5574b03f5fb440edf20b400a5937a9d46df323761357f6

SHA512
86c941b97392617a728a9f29ce0da4d8410b1bc92d47cc733f514054c8e46b7a22e8c59c9c3df81d92e3926b371fa17be841b60ceeb68b0c3aa47583b4920a4d

Download Submit
memory/4496-132-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4496-136-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download