b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47

General

Target

b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
Size

9.1MB
MD5

3757297c2b28529712c6da8e7c52d967
SHA1

1160833b9ae4d2a4fe9fb90c0553181b5add88b1
SHA256

b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47
SHA512

7766e86e2ad351f292f08c0e5522d9f3cc858485de9d0f50b5d52f8a30b8b955c9e9648f454a77de75e8a89426c6ae5f3753292450aa55b93dea4d6301d920a7
SSDEEP

196608:AeYqHzET8Wr37+YB6xe5KT8WCSTlg88iHpAEJ/mmlF4:AxqHgl+YBMUKTNjlgBivNF4

Score

7^/10

vmprotect

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2592	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2220-3-0x0000000000400000-0x0000000001C30000-memory.dmp	vmprotect
behavioral1/memory/2592-45-0x0000000000400000-0x0000000001C30000-memory.dmp	vmprotect
behavioral1/memory/2220-57-0x0000000000400000-0x0000000001C30000-memory.dmp	vmprotect
behavioral1/memory/2592-85-0x0000000000400000-0x0000000001C30000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2220	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
2220	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
2592	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
2592	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
2592	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
2592	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
2592	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2220	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
2220	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
2592	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
2592	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2592	2220	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe	28
PID 2220 wrote to memory of 2592	2220	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe	28
PID 2220 wrote to memory of 2592	2220	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe	28
PID 2220 wrote to memory of 2592	2220	b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe	28

C:\Users\Admin\AppData\Local\Temp\b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
"C:\Users\Admin\AppData\Local\Temp\b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
  C:\Users\Admin\AppData\Local\Temp\b67723336a316a369b150de956790917aaf156e77596ddd7fa70d9e6567a2f47.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ExuiKrnln.dll

Filesize
1.0MB

MD5
34cb36e76c764abc9236ca2bf66130c6

SHA1
7ad028cce5f50bfd1468935bd54074a376abf036

SHA256
8502f840936147f53ea6b3ab4b6a58264cef4a8849ba5c03a613bd402a900e7b

SHA512
3948a6c7a9b881abc1eeac6a938b5b4c4dd61d3ad6755977b800364d6e4dcd9d7847e731f6fde4a40bb8a1d70515bd3699f53bbf0fa9658563d8695be7879a0d

Download Submit
\Users\Admin\AppData\Local\Temp\ExuiKrnln.dll

Filesize
1.0MB

MD5
34cb36e76c764abc9236ca2bf66130c6

SHA1
7ad028cce5f50bfd1468935bd54074a376abf036

SHA256
8502f840936147f53ea6b3ab4b6a58264cef4a8849ba5c03a613bd402a900e7b

SHA512
3948a6c7a9b881abc1eeac6a938b5b4c4dd61d3ad6755977b800364d6e4dcd9d7847e731f6fde4a40bb8a1d70515bd3699f53bbf0fa9658563d8695be7879a0d

Download Submit
memory/2220-37-0x0000000077040000-0x0000000077041000-memory.dmp

Filesize
4KB

Download
memory/2220-5-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2220-6-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2220-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2220-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2220-13-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2220-15-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2220-3-0x0000000000400000-0x0000000001C30000-memory.dmp

Filesize
24.2MB

Download
memory/2220-20-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2220-57-0x0000000000400000-0x0000000001C30000-memory.dmp

Filesize
24.2MB

Download
memory/2220-25-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2220-28-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2220-30-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2220-31-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2220-33-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2220-35-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2220-10-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2220-18-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2220-23-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2220-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2592-45-0x0000000000400000-0x0000000001C30000-memory.dmp

Filesize
24.2MB

Download
memory/2592-51-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2592-54-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2592-49-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2592-56-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2592-60-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2592-62-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2592-65-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2592-67-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2592-78-0x0000000077040000-0x0000000077041000-memory.dmp

Filesize
4KB

Download
memory/2592-80-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2592-46-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2592-43-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2592-85-0x0000000000400000-0x0000000001C30000-memory.dmp

Filesize
24.2MB

Download

Analysis

Sharing