Resubmissions
05-11-2023 22:53
231105-2t5zvaeb2x 10Analysis
-
max time kernel
66s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
05-11-2023 22:53
General
-
Target
VTOLVR-ModLoader_H80Z7ZF.exe
-
Size
166.3MB
-
MD5
d12d22f45c51d21b1e3ffd2dd3655e83
-
SHA1
2e3d2c844d6d54c7c4b7dca41986ec9dbfacd067
-
SHA256
06f916d0e2860c5a0ae4e6256a5cf55be9e425d7a6d3ede529299be71b413b06
-
SHA512
d26536e4808590fbaa2bcb1bf6be46526b1327f1e700b1f7414a70d0f5b7c3f1e36b7cfb3eb9c393c6ed783c1d04810012375727ca85524d81c603a55ab74118
-
SSDEEP
1572864:6+8IZ6lU/gm92tuB+chCE9GQs/vvKCk6XDn:pZ6O/gmYYB+ch/9K/3KUj
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 36 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VTOLVR-ModLoader_H80Z7ZF.exe"C:\Users\Admin\AppData\Local\Temp\VTOLVR-ModLoader_H80Z7ZF.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
MD5c4974c924b605bd322c4872d72de90d1
SHA120df9433eab24d3291696046646f493794b77cba
SHA25671d766b4742ca9f7422bb2efc3dc03f2cee509a5a43d241e748cda7aaac24bf4
SHA5123889648dbb4608ece9c68f1cd5b1601da5b795eade7910764dd4769090cdb209a39acf3986e6e7190745f3bc6b1477a52dfaccb96a7e799eafc0825e2c44a846
-
Filesize
1.2MB
MD58e874bb782193fa45d027254e7d03244
SHA1024ccc78d1d23050164e8cfdf141c921f42e0c74
SHA256f75f98fbbb02dad69bcd8c69ec26eb3705dbd95dad996b58308b50e6c9904246
SHA5123f3b0f93e5600c0671688317ee00d7a88411b80b7c4aa383d274af318782a66665409a528d484409bfe598c309ed54480c86a4d4e109dee5265351d5902d0c56
-
Filesize
1.2MB
MD5b2eb7b51bd58201cf498e83846e90110
SHA1ca439759b5c5162e626d2b84ab55b93adc552e06
SHA256180557694842854789457a872df849b2130098a9c2bfd70d201f77bec6f9fddb
SHA5121a92064b3417b287246fadd88fea9138dfcc659283e063aab9305e424feac0d1b2c216be5f65ce7a95f0322ab3849478892ae407399aa6029a504c4c8a5884da
-
Filesize
5.0MB
MD51c434dc8cb09095640c776385ba69691
SHA197fe8e25bebfb7d790768175a4625d07f3d4abfd
SHA2563b3558c408c57be332c9595624f6d49413fe0dd43d3d5fa4626041851f77216a
SHA5124bdb7c0e8571422927fbc8eec6d05959915748acce035fef336b32381922a0a54f029f959fb66cb96a89a024c11e2b94ee6948f618dd04d9ae87cc83f3f83ec8
-
Filesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
Filesize
1.9MB
MD50c0be30d77de3f65e1c990b7d99143da
SHA1fd9a4e456f56308d5bed48e7049de64e88a73833
SHA25612a8b75ceecb6c5ce8ce81ad064aaf2bcb09d6338e5e03a7eddc57acd58e2a7d
SHA5129a2a6acad9b21c3f093d4d72289f32ca6ebaee304c9a9e3ec9319558919452c3b2f23ea5e72c06c9af7a2a1ded0ce266e45f4fb9113d2bb3897320fcbdf7ebad
-
Filesize
16KB
-
Filesize
280KB
-
Filesize
276KB
-
Filesize
112KB
-
Filesize
236KB
-
Filesize
8.3MB
-
Filesize
488KB
-
Filesize
16KB
-
Filesize
48KB
-
Filesize
20KB
-
Filesize
40KB
-
Filesize
76KB
-
Filesize
24KB
-
Filesize
100KB
-
Filesize
408KB
-
Filesize
1.4MB
-
Filesize
84KB
-
Filesize
92KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
2.1MB
-
Filesize
15.3MB
-
Filesize
5.1MB
-
Filesize
64KB
-
Filesize
5.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.0MB
-
Filesize
5.1MB