Resubmissions

07-08-2023 16:34

230807-t3g1dahf8x 7

07-08-2023 05:52

230807-gkplaafb5t 7

Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-08-2023 16:34

General

  • Target

    CryptoChecker v2.0.exe

  • Size

    2.2MB

  • MD5

    cb2a517209c59c5740bd544c2a7392b4

  • SHA1

    36a3da25bb5ba4a3320a14af66e663e99c3439be

  • SHA256

    cf1b7176a9955b4f0ec37689abd0d3af8fd180e1cad3a9516ada1f81cdb57126

  • SHA512

    5356b223473458f720fc52a06b88bf73e2a95ca3a3c63bcd98dca1c6a8a358af411cbbd331193b0254dc334196c2d91b8718108874de04801fb1adf611402b60

  • SSDEEP

    49152:X5ZHDTQqCkJruTWE7++reV9aF7PGN5bCKtfQWFjB1:XvHCdTj71U9apPGzztoWhr

Score
7/10

Malware Config

Signatures

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CryptoChecker v2.0.exe
    "C:\Users\Admin\AppData\Local\Temp\CryptoChecker v2.0.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4164-133-0x00007FF764EC0000-0x00007FF765456000-memory.dmp

    Filesize

    5.6MB

  • memory/4164-134-0x00007FFC096F0000-0x00007FFC098E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4164-135-0x00007FF764EC0000-0x00007FF765456000-memory.dmp

    Filesize

    5.6MB

  • memory/4164-137-0x00007FF764EC0000-0x00007FF765456000-memory.dmp

    Filesize

    5.6MB

  • memory/4164-136-0x00007FF764EC0000-0x00007FF765456000-memory.dmp

    Filesize

    5.6MB

  • memory/4164-138-0x00007FF764EC0000-0x00007FF765456000-memory.dmp

    Filesize

    5.6MB

  • memory/4164-139-0x00007FF764EC0000-0x00007FF765456000-memory.dmp

    Filesize

    5.6MB

  • memory/4164-140-0x00007FFC096F0000-0x00007FFC098E5000-memory.dmp

    Filesize

    2.0MB