turian | 67c911510e257b341be77bc2a88cedc99ace2af852f7825d9710016619875e80

Analysis

max time kernel
32s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/03/2023, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67c911510e257b341be77bc2a88cedc99ace2af852f7825d9710016619875e80.exe
Size

559KB
MD5

7b3f7c751a5c3b1823baac97ccb4d4c6
SHA1

615b5a92b6066fc992dae0d5f6abf29fe53cf2f9
SHA256

67c911510e257b341be77bc2a88cedc99ace2af852f7825d9710016619875e80
SHA512

1a42e7e925c8d9c93572c27d0fa702d1714618eb7f82288320fe1849553ed2bed52624dc30d5b2996cd973e64cc9624b564d40d856424cb060fb9ec3e4e33b07
SSDEEP

12288:399xY4k5NNrT+S4+r0qN2v/7oqYvxpteC+31PHzHxpAUSiVHR84N:3rx85PrTJr0qAv/cqG6l1PHzHvCiVHRZ

Score

10^/10

turian backdoor vmprotect

Malware Config

Extracted

Family

turian

update.delldrivers.in

Signatures

turian
C++ Backdoor attributed to the chinese APT15.
backdoor turian

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2040-54-0x0000000000400000-0x000000000054B000-memory.dmp	vmprotect

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
856	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
856	vlc.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe
856	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
856	vlc.exe

C:\Users\Admin\AppData\Local\Temp\67c911510e257b341be77bc2a88cedc99ace2af852f7825d9710016619875e80.exe
"C:\Users\Admin\AppData\Local\Temp\67c911510e257b341be77bc2a88cedc99ace2af852f7825d9710016619875e80.exe"
1⤵
PID:2040

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SplitInstall.mp3"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-63-0x000000013F100000-0x000000013F1F8000-memory.dmp

Filesize
992KB

Download
memory/856-64-0x000007FEF6630000-0x000007FEF6664000-memory.dmp

Filesize
208KB

Download
memory/856-65-0x000007FEF6140000-0x000007FEF63F4000-memory.dmp

Filesize
2.7MB

Download
memory/856-66-0x000007FEF49D0000-0x000007FEF5A7B000-memory.dmp

Filesize
16.7MB

Download
memory/856-67-0x000007FEF3CF0000-0x000007FEF3E02000-memory.dmp

Filesize
1.1MB

Download
memory/2040-54-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download