feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe
Size

6.8MB
MD5

08eb6129b9a3ea6fb4348c8b9e25e894
SHA1

5b6aa2d3bb587e09b1e31408abe75f5c224acb61
SHA256

feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd
SHA512

fdc1e51abc88f377340f5078df81cd617d946cacf9ba42e968c3a069189c27ad71adcbd9f7c563bb40f3bc1c84bb725993b96cc23906858bfd9747e2d49fcd4d
SSDEEP

98304:3SiXkxnQ9likwB4IB66DLJwAM7YyuQwzq4EHtJPZQ8X3uOCT:CiCclLwB4w66HJwAMRue4wtJK2C

Score

7^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2952-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-68-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-72-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-78-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-84-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-90-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-95-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2952-96-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2952-3-0x0000000000400000-0x000000000107C000-memory.dmp	vmprotect
behavioral1/memory/2952-6-0x0000000000400000-0x000000000107C000-memory.dmp	vmprotect
behavioral1/memory/2952-53-0x0000000000400000-0x000000000107C000-memory.dmp	vmprotect
behavioral1/memory/2952-97-0x0000000000400000-0x000000000107C000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe
2952	feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe

C:\Users\Admin\AppData\Local\Temp\feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe
"C:\Users\Admin\AppData\Local\Temp\feade3caf190e23310537a6f2a6a1066a563488f55636f97c6b34e176fe0b3dd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2952-3-0x0000000000400000-0x000000000107C000-memory.dmp

Filesize
12.5MB

Download
memory/2952-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2952-6-0x0000000000400000-0x000000000107C000-memory.dmp

Filesize
12.5MB

Download
memory/2952-7-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2952-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2952-9-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2952-11-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2952-14-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2952-16-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2952-19-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2952-21-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2952-24-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2952-26-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2952-29-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2952-31-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2952-32-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2952-34-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2952-37-0x0000000077320000-0x0000000077321000-memory.dmp

Filesize
4KB

Download
memory/2952-36-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2952-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-53-0x0000000000400000-0x000000000107C000-memory.dmp

Filesize
12.5MB

Download
memory/2952-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-68-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-72-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-78-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-84-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-90-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-93-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-95-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-96-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-97-0x0000000000400000-0x000000000107C000-memory.dmp

Filesize
12.5MB

Download