c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe
Size

824KB
MD5

b04c3df777d81c4a0925596a96d0bce0
SHA1

20be03c74cc486643110312b10510f3730e8ee92
SHA256

c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23
SHA512

09fa9fc65bf9c9be7a52967a52b31f0836b21257cebc27f1cec85e92cbe9e841a289742c66fe651899259f2a29e275501387f822e334bb6aa9d1d5f6d8dc4e2b
SSDEEP

24576:GzLds6HJMhNO8czvKpocgo9KBTrUmcikg:GNvJWczvKpDZI8FBg

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2288-0-0x0000000000400000-0x0000000000644000-memory.dmp	vmprotect
behavioral1/memory/2288-2-0x0000000000400000-0x0000000000644000-memory.dmp	vmprotect
behavioral1/memory/2288-5-0x0000000000400000-0x0000000000644000-memory.dmp	vmprotect

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2712	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	28
PID 2288 wrote to memory of 2712	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	28
PID 2288 wrote to memory of 2712	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	28
PID 2288 wrote to memory of 2712	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	28
PID 2288 wrote to memory of 2712	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	28
PID 2288 wrote to memory of 2712	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	28
PID 2288 wrote to memory of 2712	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	28
PID 2288 wrote to memory of 2568	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	29
PID 2288 wrote to memory of 2568	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	29
PID 2288 wrote to memory of 2568	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	29
PID 2288 wrote to memory of 2568	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	29
PID 2288 wrote to memory of 2568	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	29
PID 2288 wrote to memory of 2568	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	29
PID 2288 wrote to memory of 2568	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	29
PID 2288 wrote to memory of 3036	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	30
PID 2288 wrote to memory of 3036	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	30
PID 2288 wrote to memory of 3036	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	30
PID 2288 wrote to memory of 3036	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	30
PID 2288 wrote to memory of 3036	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	30
PID 2288 wrote to memory of 3036	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	30
PID 2288 wrote to memory of 3036	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	30
PID 2288 wrote to memory of 2112	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	31
PID 2288 wrote to memory of 2112	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	31
PID 2288 wrote to memory of 2112	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	31
PID 2288 wrote to memory of 2112	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	31
PID 2288 wrote to memory of 2112	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	31
PID 2288 wrote to memory of 2112	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	31
PID 2288 wrote to memory of 2112	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	31
PID 2288 wrote to memory of 2584	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	32
PID 2288 wrote to memory of 2584	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	32
PID 2288 wrote to memory of 2584	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	32
PID 2288 wrote to memory of 2584	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	32
PID 2288 wrote to memory of 2584	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	32
PID 2288 wrote to memory of 2584	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	32
PID 2288 wrote to memory of 2584	2288	c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe	32

C:\Users\Admin\AppData\Local\Temp\c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe
"C:\Users\Admin\AppData\Local\Temp\c10115c1ea826deb0ada71ba2241d5b76f667aec296edfe1573f7af5d31a2d23.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\ocx\COMCTL32.OCX"
  2⤵
  PID:2712
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\ocx\TABCTL32.OCX"
  2⤵
  PID:2568
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\ocx\ccrpTmr6.dll"
  2⤵
  PID:3036
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\ocx\MSINET.OCX"
  2⤵
  PID:2112
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\ocx\MSWINSCK.OCX"
  2⤵
  PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2288-0-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2288-1-0x0000000000AB0000-0x0000000000CF4000-memory.dmp

Filesize
2.3MB

Download
memory/2288-2-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2288-5-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download