Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
22-11-2023 14:00
General
-
Target
æ·˜å®é‡‡é›†ä¸‹å•VV28.exe
-
Size
21.7MB
-
MD5
47664c6f22ecc22438161899f4bae933
-
SHA1
1cf558bbd8d8ff548391ee03606b1ce682580e30
-
SHA256
f5fb6410aa2151ceac5d1d9b70eb92e10f566d9a679fef0d420d8a656eb3c8f9
-
SHA512
5488a619a4b07e8423ab2381adb88a8bd657a9caf97c9a416a462890400ff601300ece8cff4a7b6c93fc58939a89b59de47acb987bb08058a892161da75fb8ec
-
SSDEEP
393216:O2ukHuBmX3Ek3RqUp9UBLu4GpD1rGpxO+bIo3xtptmVfwU40hKg+cuTBaUpFMUN:3uauAX393vUBS4G/GvOitptkfeyKg+FR
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\æ·˜å®é‡‡é›†ä¸‹å•VV28.exe"C:\Users\Admin\AppData\Local\Temp\æ·˜å®é‡‡é›†ä¸‹å•VV28.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dllFilesize
8.4MB
MD58b6c94bbdbfb213e94a5dcb4fac28ce3
SHA1b56102ca4f03556f387f8b30e2b404efabe0cb65
SHA256982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53
SHA5129d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a
-
memory/2832-0-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2832-2-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2832-6-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2832-5-0x0000000000400000-0x000000000352B000-memory.dmpFilesize
49.2MB
-
memory/2832-4-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2832-8-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2832-10-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2832-14-0x0000000000400000-0x000000000352B000-memory.dmpFilesize
49.2MB
-
memory/2832-13-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2832-16-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2832-19-0x0000000003530000-0x0000000003531000-memory.dmpFilesize
4KB
-
memory/2832-21-0x0000000003530000-0x0000000003531000-memory.dmpFilesize
4KB
-
memory/2832-24-0x0000000003540000-0x0000000003541000-memory.dmpFilesize
4KB
-
memory/2832-26-0x0000000003540000-0x0000000003541000-memory.dmpFilesize
4KB
-
memory/2832-29-0x0000000003550000-0x0000000003551000-memory.dmpFilesize
4KB
-
memory/2832-31-0x0000000003550000-0x0000000003551000-memory.dmpFilesize
4KB
-
memory/2832-32-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/2832-34-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/2832-36-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/2832-37-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/2832-38-0x0000000077C50000-0x0000000077C51000-memory.dmpFilesize
4KB
-
memory/2832-40-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/2832-42-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/2832-50-0x0000000006230000-0x0000000006A8B000-memory.dmpFilesize
8.4MB
-
memory/2832-53-0x0000000006230000-0x0000000006A8B000-memory.dmpFilesize
8.4MB
-
memory/2832-57-0x0000000004E40000-0x0000000004E67000-memory.dmpFilesize
156KB
-
memory/2832-58-0x0000000004E40000-0x0000000004E67000-memory.dmpFilesize
156KB
-
memory/2832-59-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-61-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-63-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-64-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-65-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-68-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-71-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-74-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-77-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-86-0x0000000000400000-0x000000000352B000-memory.dmpFilesize
49.2MB
-
memory/2832-93-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-101-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-99-0x0000000006230000-0x0000000006A8B000-memory.dmpFilesize
8.4MB
-
memory/2832-105-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-107-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-111-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-114-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-118-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-119-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-121-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2832-122-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/2832-123-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB