60c980dccba75cb084f81901e3cc16321fecb5bad186c39452d4267a62903e9b

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

60c980dccba75cb084f81901e3cc16321fecb5bad186c39452d4267a62903e9b.exe
Size

11.8MB
MD5

d6562ed85c6cd063f60a92bd3562a5a0
SHA1

e310980272960502dc9994ecf02cae7ebbfc75bc
SHA256

60c980dccba75cb084f81901e3cc16321fecb5bad186c39452d4267a62903e9b
SHA512

93d80675c880dc66e502059ad987f5be2fd87130bb5e5d3065d27c16a8b3c53f2233fb5c086d5934c6f992da499ea26eeade096a4175f3d54433479cd888cc4f
SSDEEP

196608:9yn9Q6Qfx86hAq7jDNhWVz36YJVRiFXwXw9Jzdm3W33/33W33X3J3d3rfFaENA+i:9S9Q6sx8CfDNhWJ36Yt/MENAzb

Score

7^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2612-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-53-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-62-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-66-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-68-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-78-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-84-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-88-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-92-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2612-94-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2612-2-0x0000000000400000-0x000000000189D000-memory.dmp	vmprotect
behavioral1/memory/2612-58-0x0000000000400000-0x000000000189D000-memory.dmp	vmprotect
behavioral1/memory/2612-95-0x0000000000400000-0x000000000189D000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2612	60c980dccba75cb084f81901e3cc16321fecb5bad186c39452d4267a62903e9b.exe
2612	60c980dccba75cb084f81901e3cc16321fecb5bad186c39452d4267a62903e9b.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2612	60c980dccba75cb084f81901e3cc16321fecb5bad186c39452d4267a62903e9b.exe
2612	60c980dccba75cb084f81901e3cc16321fecb5bad186c39452d4267a62903e9b.exe
2612	60c980dccba75cb084f81901e3cc16321fecb5bad186c39452d4267a62903e9b.exe

C:\Users\Admin\AppData\Local\Temp\60c980dccba75cb084f81901e3cc16321fecb5bad186c39452d4267a62903e9b.exe
"C:\Users\Admin\AppData\Local\Temp\60c980dccba75cb084f81901e3cc16321fecb5bad186c39452d4267a62903e9b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2612-0-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2612-2-0x0000000000400000-0x000000000189D000-memory.dmp

Filesize
20.6MB

Download
memory/2612-3-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2612-5-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2612-6-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2612-8-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2612-10-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2612-13-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2612-15-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2612-18-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2612-20-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2612-23-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2612-25-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2612-28-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2612-30-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2612-31-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2612-33-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2612-36-0x0000000077930000-0x0000000077931000-memory.dmp

Filesize
4KB

Download
memory/2612-35-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2612-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-51-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-53-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-58-0x0000000000400000-0x000000000189D000-memory.dmp

Filesize
20.6MB

Download
memory/2612-62-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-64-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-66-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-68-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-78-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-84-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-88-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-92-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-94-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2612-95-0x0000000000400000-0x000000000189D000-memory.dmp

Filesize
20.6MB

Download