55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe
Size

6.8MB
MD5

9f3686045974dae48830cb460ffa5aca
SHA1

03482a37ff43c344799d6024bbdcfffd167dbb17
SHA256

55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6
SHA512

095a58de974e1364f793a209e6b363fe42ee9a25afe73088b2416ba915116b11c05f30b9591b9dc72d18b4da81353faac352949fc2b60dbfdeb27f637b415dca
SSDEEP

98304:fNQsAOUOow2P6QS1gpElXqZnXOCpWpemE9u+N25+mZmgeNGgBMqJl08N6vzClQ7:fBnUOorP6QSrqBWytQ5+5JJlhN6L

Score

7^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1972-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-53-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-73-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-76-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-84-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-82-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-88-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-91-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-96-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-94-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1972-97-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1972-3-0x0000000000400000-0x000000000107F000-memory.dmp	vmprotect
behavioral1/memory/1972-7-0x0000000000400000-0x000000000107F000-memory.dmp	vmprotect
behavioral1/memory/1972-55-0x0000000000400000-0x000000000107F000-memory.dmp	vmprotect
behavioral1/memory/1972-98-0x0000000000400000-0x000000000107F000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe
1972	55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe

C:\Users\Admin\AppData\Local\Temp\55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe
"C:\Users\Admin\AppData\Local\Temp\55a95ca3d5e98ab3e35a25e964294d6306f1a3df3a5b5d18947a416e5e2618a6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1972-3-0x0000000000400000-0x000000000107F000-memory.dmp

Filesize
12.5MB

Download
memory/1972-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1972-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1972-7-0x0000000000400000-0x000000000107F000-memory.dmp

Filesize
12.5MB

Download
memory/1972-6-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1972-9-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1972-11-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1972-16-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1972-14-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1972-19-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1972-21-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1972-26-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1972-24-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1972-31-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1972-29-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1972-37-0x0000000077480000-0x0000000077481000-memory.dmp

Filesize
4KB

Download
memory/1972-36-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1972-34-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1972-32-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1972-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-51-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-53-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-55-0x0000000000400000-0x000000000107F000-memory.dmp

Filesize
12.5MB

Download
memory/1972-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-73-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-76-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-84-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-82-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-88-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-91-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-96-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-94-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-97-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1972-98-0x0000000000400000-0x000000000107F000-memory.dmp

Filesize
12.5MB

Download