9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2023 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376.exe
Size

4.3MB
MD5

d1336b3fef787b91d374822dc653b559
SHA1

fa58246e9fde9945c03367b3884f4056a34ebdb9
SHA256

9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376
SHA512

560b47bf365f4d8a9e86bf87f0d527c34160bdcc17eccd3e1d5947b32a47b5fe48a2aecde9b7fb5c9fb017d5d83967ecf76c99de2646b94705afe926beb2a2bf
SSDEEP

98304:4s1K6itHZOdaMBuCs2ild3F9eMlYdinxWh+srFAmsPW2YOg8ylAPajVt:4s1KlHO5oecdxqQxEB0PWth8ykeT

Score

7^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4952-11-0x0000000002E20000-0x0000000002E46000-memory.dmp	upx
behavioral2/memory/4952-16-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-20-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-31-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-40-0x0000000002E20000-0x0000000002E46000-memory.dmp	upx
behavioral2/memory/4952-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-53-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4952-68-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4952-2-0x0000000000400000-0x0000000000E0B000-memory.dmp	vmprotect
behavioral2/memory/4952-33-0x0000000000400000-0x0000000000E0B000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4952	9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376.exe
4952	9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376.exe
4952	9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376.exe
4952	9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4952	9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4952	9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376.exe
4952	9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376.exe
4952	9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376.exe

C:\Users\Admin\AppData\Local\Temp\9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376.exe
"C:\Users\Admin\AppData\Local\Temp\9926563e1aa32dd3a3d46ce974a75c078aa766b5f90b94d8fdea53edcc91e376.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_261DF94B8A0B49F48FCE36C858AD68E2.dat

Filesize
940B

MD5
1909d517b2c0af374cfa399137e077f7

SHA1
efa0e98e50dc87a60b99322a482e39676d98f845

SHA256
e788f1029e681b52c68fc733fd99c32128086a691c45e746516a77c113a33f1a

SHA512
9fdd6cae3ff33bb88a6a08bb18253f7f6ee74e8927b9571d27f6744f1821ec5df8824dd882252feb309884075c720ce503dfd53e5965116514ae9c12afbcc229

Download Submit
memory/4952-31-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-2-0x0000000000400000-0x0000000000E0B000-memory.dmp

Filesize
10.0MB

Download
memory/4952-4-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Filesize
4KB

Download
memory/4952-3-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Filesize
4KB

Download
memory/4952-6-0x0000000002D00000-0x0000000002D01000-memory.dmp

Filesize
4KB

Download
memory/4952-5-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4952-7-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/4952-11-0x0000000002E20000-0x0000000002E46000-memory.dmp

Filesize
152KB

Download
memory/4952-33-0x0000000000400000-0x0000000000E0B000-memory.dmp

Filesize
10.0MB

Download
memory/4952-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-20-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-18-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-0-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/4952-16-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-1-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/4952-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-40-0x0000000002E20000-0x0000000002E46000-memory.dmp

Filesize
152KB

Download
memory/4952-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-51-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-53-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4952-68-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download