89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c

General

Target

89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
Size

9.4MB
MD5

5e3d56bca2a37b5781f75cdf86a3b0cb
SHA1

b07c41391ebd8da028cba1be78c78b0f93bcf092
SHA256

89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c
SHA512

c9a432bbae8da4fad1ce2239145777afef5e60d8c2a2b4ee544c9db661a5fe890d340440064840c90f362dab0cc804cf4df2481a210811117364fff2a2a09297
SSDEEP

196608:pS7mQRwHNLJuAdooVj4ImBELJsQdmjsCROjK/sf8wryRvJHOvlWk+Z1O:JZVL4CddvjK/MGvBSlWlO

Score

7^/10

vmprotect

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2728	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/3000-5-0x0000000000400000-0x0000000001DFF000-memory.dmp	vmprotect
behavioral1/memory/3000-42-0x0000000000400000-0x0000000001DFF000-memory.dmp	vmprotect
behavioral1/memory/3000-43-0x0000000000400000-0x0000000001DFF000-memory.dmp	vmprotect
behavioral1/memory/2728-49-0x0000000000400000-0x0000000001DFF000-memory.dmp	vmprotect
behavioral1/memory/2728-87-0x0000000000400000-0x0000000001DFF000-memory.dmp	vmprotect
behavioral1/memory/2728-88-0x0000000000400000-0x0000000001DFF000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3000	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
3000	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
2728	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
2728	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
2728	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
2728	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
2728	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3000	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
3000	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
2728	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
2728	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2728	3000	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe	29
PID 3000 wrote to memory of 2728	3000	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe	29
PID 3000 wrote to memory of 2728	3000	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe	29
PID 3000 wrote to memory of 2728	3000	89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe	29

C:\Users\Admin\AppData\Local\Temp\89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
"C:\Users\Admin\AppData\Local\Temp\89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
  C:\Users\Admin\AppData\Local\Temp\89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32.lib

Filesize
1.6MB

MD5
031ad1ecd93701d39265771942ec716c

SHA1
cb3ef507bf0e848894fbb96a29bfc94a0c302152

SHA256
9a7fde2ea7883701bf858e0daef74d787a31c3cbd9f1171cec0a3a382ee9e6ba

SHA512
374dab32b6304834c7acd8b5e6701ece016bf57d3abdd416ef2b63f7cbda24c9e59f9dfc27b6823ac6256bbab38aace74334dec7d57f1ef6cb9b80c239003bae

Download Submit
\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32.lib

Filesize
1.6MB

MD5
031ad1ecd93701d39265771942ec716c

SHA1
cb3ef507bf0e848894fbb96a29bfc94a0c302152

SHA256
9a7fde2ea7883701bf858e0daef74d787a31c3cbd9f1171cec0a3a382ee9e6ba

SHA512
374dab32b6304834c7acd8b5e6701ece016bf57d3abdd416ef2b63f7cbda24c9e59f9dfc27b6823ac6256bbab38aace74334dec7d57f1ef6cb9b80c239003bae

Download Submit
memory/2728-49-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/2728-88-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/2728-87-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/2728-82-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2728-80-0x0000000077670000-0x0000000077671000-memory.dmp

Filesize
4KB

Download
memory/2728-64-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2728-67-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2728-69-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2728-62-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/3000-15-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3000-20-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/3000-28-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/3000-30-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/3000-31-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/3000-33-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/3000-35-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/3000-37-0x0000000077670000-0x0000000077671000-memory.dmp

Filesize
4KB

Download
memory/3000-42-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3000-43-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3000-23-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/3000-25-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/3000-18-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/3000-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3000-13-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3000-10-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3000-8-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3000-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3000-6-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3000-5-0x0000000000400000-0x0000000001DFF000-memory.dmp

Filesize
26.0MB

Download
memory/3000-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing