Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    23-10-2023 23:36

General

  • Target

    7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe

  • Size

    5.1MB

  • MD5

    3445f2023fad401f36ab6511b1c78402

  • SHA1

    7fc76e6526c3d2c082540a6695949249fd6fb962

  • SHA256

    7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44

  • SHA512

    cf3f49fd5a109d19a450625c1f1f4b59a8ce04183fcc23c62fd042d63e1b1ec0993e0f295f476bb5b95f46348cd3dfd74288c624ac9bb8fec2eed4f646019d3d

  • SSDEEP

    98304:yKPCHgDN8mH0Pad2OWEJ0oAlVGwMgJAMJxZvuwI/vxiUVAlc4JBFn:yKTDN8miOeoAlz/FC/vsUKlc4

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe
    "C:\Users\Admin\AppData\Local\Temp\7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\datatemp\libcurl.dll

    Filesize

    2.5MB

    MD5

    298f5812023bab65ee23d13ee9489a6e

    SHA1

    71e9d7f205e5e7af6907c539c77a3aeea971692f

    SHA256

    fe100d35b034c15ae3b74379f4eedd321c8e4b84fe666b54ee924ca2a8bdca6e

    SHA512

    217258fb7728f61199f913fb98c894077c12a124e1596d1c6c7cfc065d4d2a6e1e03ad950c3321e2a8dcd997fb5c9524f98530db4bcb39f9914ecb5ff0e22dbd

  • memory/2192-0-0x0000000000400000-0x0000000000F3E000-memory.dmp

    Filesize

    11.2MB

  • memory/2192-1-0x00000000770B0000-0x00000000770B1000-memory.dmp

    Filesize

    4KB

  • memory/2192-4-0x0000000000400000-0x0000000000F3E000-memory.dmp

    Filesize

    11.2MB

  • memory/2192-3-0x00000000770B0000-0x00000000770B1000-memory.dmp

    Filesize

    4KB

  • memory/2192-8-0x0000000074AB0000-0x0000000074AB1000-memory.dmp

    Filesize

    4KB

  • memory/2192-12-0x0000000074AB0000-0x0000000074AB1000-memory.dmp

    Filesize

    4KB

  • memory/2192-13-0x00000000770B0000-0x00000000770B1000-memory.dmp

    Filesize

    4KB

  • memory/2192-21-0x0000000005450000-0x0000000005495000-memory.dmp

    Filesize

    276KB

  • memory/2192-22-0x0000000000400000-0x0000000000F3E000-memory.dmp

    Filesize

    11.2MB

  • memory/2192-23-0x0000000000400000-0x0000000000F3E000-memory.dmp

    Filesize

    11.2MB