015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9

General

Target

015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe
Size

5.7MB
MD5

06d51eba5329714f34565ff6be36f525
SHA1

47bb5130d05bcbd9551fbcd0aff303f4ac5074f2
SHA256

015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9
SHA512

1f4c026d7cb099911c9d31b2ff35ff562c5a84f5e54b35869355d1b4c23d2b9ae1de5c1b564575f457c8a10479108c40c94ff9016ecb0c7cae27b286877388cd
SSDEEP

98304:y0j1Ij9ZLj7kTVOV3lXLeUcq1cM4DoctB/pUc+crheufhqb0oWnybXEnumqTwQnK:y0jahZQZO9hLeUcq74DoCN+crtMwnuml

Score

8^/10

vmprotect

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1736-75-0x0000000000400000-0x0000000000F46000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe

pid process

1736 015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe

pid	process
1736	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe
1736	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe
1736	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe

pid	process
1736	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe
1736	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe
1736	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe
1736	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.execmd.exe

description	pid	process	target process
PID 1736 wrote to memory of 568	1736	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe	cmd.exe
PID 1736 wrote to memory of 568	1736	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe	cmd.exe
PID 1736 wrote to memory of 568	1736	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe	cmd.exe
PID 1736 wrote to memory of 568	1736	015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe	cmd.exe
PID 568 wrote to memory of 364	568	cmd.exe	cacls.exe
PID 568 wrote to memory of 364	568	cmd.exe	cacls.exe
PID 568 wrote to memory of 364	568	cmd.exe	cacls.exe
PID 568 wrote to memory of 364	568	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe
"C:\Users\Admin\AppData\Local\Temp\015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls.exe c:\windows\system32\drivers\etc\hosts /e /t /p everyone:F
2⤵
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\cacls.exe
cacls.exe c:\windows\system32\drivers\etc\hosts /e /t /p everyone:F
3⤵
PID:364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1736-55-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1736-56-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1736-57-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1736-58-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1736-59-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1736-61-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1736-62-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1736-64-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1736-65-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1736-67-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1736-68-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1736-70-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1736-71-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1736-72-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1736-73-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1736-74-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1736-75-0x0000000000400000-0x0000000000F46000-memory.dmp

Filesize
11.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads