fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9

General

Target

fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
Size

268KB
MD5

f2721732ff0ed5de185dab4e0b433f4c
SHA1

10312d323a4983cb0db74b38313bf21636ac5e52
SHA256

fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9
SHA512

11d5b302a2105ea83a30158f75241b79bf04a290c6dd89f9f4cd6d0e6c0c2ad0c04fc1a96bf02cf39eeeabf5d5ca4a77a165c1029a1ba6c22aa9740fe10bdde4
SSDEEP

3072:6dJnDc7AzqAZu+6nnDUmGOu/5FzMmEYLqYtmrmqcfU28joJsDBFs8H9XqJJuzIf+:6Pw7rRD5kjIxsT+bdjoeHQJkddtZ

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/files/0x000800000001231e-54.dat	vmprotect

Deletes itself 1 IoCs

pid	Process
1516	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\zkjiek1.dat	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
File opened for modification	C:\Windows\SysWOW64\zkjiek2.dat	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
File created	C:\Windows\SysWOW64\zkjiek2.dat	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
File opened for modification	C:\Windows\SysWOW64\zkjiek3.dat	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
File created	C:\Windows\SysWOW64\zkjiek3.dat	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
File opened for modification	C:\Windows\SysWOW64\zkjiek5.dat	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
File created	C:\Windows\SysWOW64\zkjiek5.dat	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
File created	C:\Windows\SysWOW64\ljovew.dat	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
File created	C:\Windows\SysWOW64\zkjiek1.dat	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
File opened for modification	C:\Windows\SysWOW64\zkjiek4.dat	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
File created	C:\Windows\SysWOW64\zkjiek4.dat	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
File created	C:\Windows\SysWOW64\cyqnzlntj.dll	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
464	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1464	948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe	28
PID 948 wrote to memory of 1464	948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe	28
PID 948 wrote to memory of 1464	948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe	28
PID 948 wrote to memory of 1464	948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe	28
PID 948 wrote to memory of 1464	948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe	28
PID 948 wrote to memory of 1464	948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe	28
PID 948 wrote to memory of 1464	948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe	28
PID 948 wrote to memory of 1516	948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe	29
PID 948 wrote to memory of 1516	948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe	29
PID 948 wrote to memory of 1516	948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe	29
PID 948 wrote to memory of 1516	948	fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe	29

C:\Users\Admin\AppData\Local\Temp\fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe
"C:\Users\Admin\AppData\Local\Temp\fa9e91179119dfda518f427968a54004cc67e326f24345bf1415746a889a9ba9.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe c:\Progra~1\dnf\cyqnzlntj.dll Porn
  2⤵
  PID:1464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\FA9E91~1.EXE
  2⤵
  - Deletes itself
  PID:1516

\Windows\SysWOW64\cyqnzlntj.dll

Filesize
111KB

MD5
4c97e9f30d4fffcf9e693acc213f1294

SHA1
f30c0bfff69b031587a8d34ff91ea49faca6f700

SHA256
9fd4690d05e916dc62304ae629eacb0acdbc8ec07daf055593cf4ef6f223490f

SHA512
69745512fc2a169ad4be03f0786e3baeb45dcd3543b56e077cb0182b32acb3f8548ec5393bd7d27e05b6c7c6b0461f67c9944577e261ab71aed3c3c1f5175bbd

Download Submit
memory/1464-56-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download