Analysis

  • max time kernel
    22s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    27-04-2023 13:27

General

  • Target

    vdcs.exe

  • Size

    726.4MB

  • MD5

    8e550f6a030e464657cad196e93b54ef

  • SHA1

    2ccc4dbb3efe605dd3d68cacbd98ecbb91c42284

  • SHA256

    8a4556d74daa2806d18dc91baacd78214e0aec0403daf9cbfdf75b18894a1eb0

  • SHA512

    e59aae5ac79c667bbdf52dc26108610c6e871da231122c36117c94b103a60bd20ed59b30ae4dae520c777574f76a1e6199fe2606d7cdb888a7f9da20b66d7ba9

  • SSDEEP

    98304:ponC5g4H7xXJqStkoRYXGRdKocRaG/n85B7Gv9n+J4P6F9RuBhSMf5rXEAxbxtq2:pz5z1JNSo2XlzuB7M9nRYuXzf+ABZb

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vdcs.exe
    "C:\Users\Admin\AppData\Local\Temp\vdcs.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1360-55-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/1360-54-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/1360-56-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/1360-57-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/1360-58-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/1360-59-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/1360-61-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/1360-60-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/1360-62-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/1360-63-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/1360-64-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/1360-65-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/1360-67-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/1360-68-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/1360-70-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1360-71-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1360-73-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/1360-74-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/1360-76-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/1360-77-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/1360-78-0x0000000000400000-0x0000000000E14000-memory.dmp

    Filesize

    10.1MB