Analysis

  • max time kernel
    142s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-10-2023 23:36

General

  • Target

    7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe

  • Size

    5.1MB

  • MD5

    3445f2023fad401f36ab6511b1c78402

  • SHA1

    7fc76e6526c3d2c082540a6695949249fd6fb962

  • SHA256

    7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44

  • SHA512

    cf3f49fd5a109d19a450625c1f1f4b59a8ce04183fcc23c62fd042d63e1b1ec0993e0f295f476bb5b95f46348cd3dfd74288c624ac9bb8fec2eed4f646019d3d

  • SSDEEP

    98304:yKPCHgDN8mH0Pad2OWEJ0oAlVGwMgJAMJxZvuwI/vxiUVAlc4JBFn:yKTDN8miOeoAlz/FC/vsUKlc4

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe
    "C:\Users\Admin\AppData\Local\Temp\7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\datatemp\libcurl.dll

    Filesize

    2.5MB

    MD5

    298f5812023bab65ee23d13ee9489a6e

    SHA1

    71e9d7f205e5e7af6907c539c77a3aeea971692f

    SHA256

    fe100d35b034c15ae3b74379f4eedd321c8e4b84fe666b54ee924ca2a8bdca6e

    SHA512

    217258fb7728f61199f913fb98c894077c12a124e1596d1c6c7cfc065d4d2a6e1e03ad950c3321e2a8dcd997fb5c9524f98530db4bcb39f9914ecb5ff0e22dbd

  • memory/5052-0-0x0000000000400000-0x0000000000F3E000-memory.dmp

    Filesize

    11.2MB

  • memory/5052-2-0x0000000000400000-0x0000000000F3E000-memory.dmp

    Filesize

    11.2MB

  • memory/5052-4-0x0000000077290000-0x0000000077291000-memory.dmp

    Filesize

    4KB

  • memory/5052-5-0x0000000077E70000-0x0000000077E71000-memory.dmp

    Filesize

    4KB

  • memory/5052-14-0x0000000000400000-0x0000000000F3E000-memory.dmp

    Filesize

    11.2MB

  • memory/5052-16-0x0000000003020000-0x0000000003021000-memory.dmp

    Filesize

    4KB

  • memory/5052-15-0x0000000003030000-0x0000000003031000-memory.dmp

    Filesize

    4KB

  • memory/5052-17-0x0000000000400000-0x0000000000F3E000-memory.dmp

    Filesize

    11.2MB

  • memory/5052-18-0x0000000002D50000-0x0000000002E23000-memory.dmp

    Filesize

    844KB

  • memory/5052-19-0x0000000003030000-0x0000000003031000-memory.dmp

    Filesize

    4KB

  • memory/5052-20-0x0000000003020000-0x0000000003021000-memory.dmp

    Filesize

    4KB