Analysis

  • max time kernel
    120s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 12:51

General

  • Target

    89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe

  • Size

    9.4MB

  • MD5

    5e3d56bca2a37b5781f75cdf86a3b0cb

  • SHA1

    b07c41391ebd8da028cba1be78c78b0f93bcf092

  • SHA256

    89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c

  • SHA512

    c9a432bbae8da4fad1ce2239145777afef5e60d8c2a2b4ee544c9db661a5fe890d340440064840c90f362dab0cc804cf4df2481a210811117364fff2a2a09297

  • SSDEEP

    196608:pS7mQRwHNLJuAdooVj4ImBELJsQdmjsCROjK/sf8wryRvJHOvlWk+Z1O:JZVL4CddvjK/MGvBSlWlO

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 6 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
    "C:\Users\Admin\AppData\Local\Temp\89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Users\Admin\AppData\Local\Temp\89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
      C:\Users\Admin\AppData\Local\Temp\89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32.lib

    Filesize

    1.6MB

    MD5

    031ad1ecd93701d39265771942ec716c

    SHA1

    cb3ef507bf0e848894fbb96a29bfc94a0c302152

    SHA256

    9a7fde2ea7883701bf858e0daef74d787a31c3cbd9f1171cec0a3a382ee9e6ba

    SHA512

    374dab32b6304834c7acd8b5e6701ece016bf57d3abdd416ef2b63f7cbda24c9e59f9dfc27b6823ac6256bbab38aace74334dec7d57f1ef6cb9b80c239003bae

  • \Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32.lib

    Filesize

    1.6MB

    MD5

    031ad1ecd93701d39265771942ec716c

    SHA1

    cb3ef507bf0e848894fbb96a29bfc94a0c302152

    SHA256

    9a7fde2ea7883701bf858e0daef74d787a31c3cbd9f1171cec0a3a382ee9e6ba

    SHA512

    374dab32b6304834c7acd8b5e6701ece016bf57d3abdd416ef2b63f7cbda24c9e59f9dfc27b6823ac6256bbab38aace74334dec7d57f1ef6cb9b80c239003bae

  • memory/2728-49-0x0000000000400000-0x0000000001DFF000-memory.dmp

    Filesize

    26.0MB

  • memory/2728-88-0x0000000000400000-0x0000000001DFF000-memory.dmp

    Filesize

    26.0MB

  • memory/2728-87-0x0000000000400000-0x0000000001DFF000-memory.dmp

    Filesize

    26.0MB

  • memory/2728-82-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/2728-80-0x0000000077670000-0x0000000077671000-memory.dmp

    Filesize

    4KB

  • memory/2728-64-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2728-67-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/2728-69-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/2728-62-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/3000-15-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/3000-20-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/3000-28-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/3000-30-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/3000-31-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/3000-33-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/3000-35-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/3000-37-0x0000000077670000-0x0000000077671000-memory.dmp

    Filesize

    4KB

  • memory/3000-42-0x0000000000400000-0x0000000001DFF000-memory.dmp

    Filesize

    26.0MB

  • memory/3000-43-0x0000000000400000-0x0000000001DFF000-memory.dmp

    Filesize

    26.0MB

  • memory/3000-23-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/3000-25-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/3000-18-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/3000-0-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/3000-13-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/3000-10-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/3000-8-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/3000-4-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/3000-6-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/3000-5-0x0000000000400000-0x0000000001DFF000-memory.dmp

    Filesize

    26.0MB

  • memory/3000-2-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB