11c8be5f71d42917925dae20dc8e36c71edf7485affde6f575357d67aced1d81

Analysis

max time kernel
120s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11c8be5f71d42917925dae20dc8e36c71edf7485affde6f575357d67aced1d81.exe
Size

13.5MB
MD5

c40fd2ce72d1a94718d2b3f6932ec50b
SHA1

59035c05fb9708822a548ff8763c7961d77e9ff2
SHA256

11c8be5f71d42917925dae20dc8e36c71edf7485affde6f575357d67aced1d81
SHA512

4eb06093a5bba912e3c68286240c5303e1000fdc00c3e5e736ff851ab4cac6ac77526183c5bac9ac5cf6581a33c728a37eb774334c0b2d560bda01afc20ebfed
SSDEEP

393216:w5CEeoyWluJTR+BvU6p9UeIrx/wdG3TNjAauFc:8CNbsUdrx46pUK

Score

7^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2068-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-53-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-78-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-84-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-90-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-96-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-99-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-102-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-105-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-108-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-110-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2068-111-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2068-0-0x0000000000400000-0x0000000001F46000-memory.dmp	vmprotect
behavioral1/memory/2068-6-0x0000000000400000-0x0000000001F46000-memory.dmp	vmprotect
behavioral1/memory/2068-46-0x0000000000400000-0x0000000001F46000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2068	11c8be5f71d42917925dae20dc8e36c71edf7485affde6f575357d67aced1d81.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2068	11c8be5f71d42917925dae20dc8e36c71edf7485affde6f575357d67aced1d81.exe
2068	11c8be5f71d42917925dae20dc8e36c71edf7485affde6f575357d67aced1d81.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2068	11c8be5f71d42917925dae20dc8e36c71edf7485affde6f575357d67aced1d81.exe
2068	11c8be5f71d42917925dae20dc8e36c71edf7485affde6f575357d67aced1d81.exe
2068	11c8be5f71d42917925dae20dc8e36c71edf7485affde6f575357d67aced1d81.exe

C:\Users\Admin\AppData\Local\Temp\11c8be5f71d42917925dae20dc8e36c71edf7485affde6f575357d67aced1d81.exe
"C:\Users\Admin\AppData\Local\Temp\11c8be5f71d42917925dae20dc8e36c71edf7485affde6f575357d67aced1d81.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-0-0x0000000000400000-0x0000000001F46000-memory.dmp

Filesize
27.3MB

Download
memory/2068-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2068-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2068-7-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2068-6-0x0000000000400000-0x0000000001F46000-memory.dmp

Filesize
27.3MB

Download
memory/2068-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2068-9-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2068-16-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/2068-14-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/2068-11-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2068-21-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/2068-19-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/2068-24-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/2068-26-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/2068-29-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/2068-32-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/2068-31-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/2068-34-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/2068-37-0x0000000077320000-0x0000000077321000-memory.dmp

Filesize
4KB

Download
memory/2068-38-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/2068-36-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/2068-40-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/2068-42-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/2068-46-0x0000000000400000-0x0000000001F46000-memory.dmp

Filesize
27.3MB

Download
memory/2068-51-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-53-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-78-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-84-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-90-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-93-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-96-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-99-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-102-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-105-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-108-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-110-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2068-111-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download