Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/12/2023, 05:28

General

  • Target

    f2fc86ac97be7dd994c3d20ee9a58f48eb7dc780ea273daf24c5343b90bb9973.exe

  • Size

    11.5MB

  • MD5

    e0ac8681c53c9caf51042246b15d122d

  • SHA1

    90cf66858157540e6c39fb2c4b2d4562c16f935c

  • SHA256

    f2fc86ac97be7dd994c3d20ee9a58f48eb7dc780ea273daf24c5343b90bb9973

  • SHA512

    f970b3c3acc9aa1a026f9d3f4133e76e04fca86ea2e56db56b1de60dc15123f17caef8ff24a5b7eda8029026c73b2364695e9eebf2bad503c405f26dba98ce7c

  • SSDEEP

    196608:HPCUhW2aj2/yZL8W/q2F54b85va9QX+9bueDD0z3au7fuCalZozAR8E:KEWD2/yKWqIuF9bnDD0jaouCzs

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • VMProtect packed file 8 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2fc86ac97be7dd994c3d20ee9a58f48eb7dc780ea273daf24c5343b90bb9973.exe
    "C:\Users\Admin\AppData\Local\Temp\f2fc86ac97be7dd994c3d20ee9a58f48eb7dc780ea273daf24c5343b90bb9973.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3520
    • C:\Users\Admin\AppData\Local\Temp\Patch.exe
      C:\Users\Admin\AppData\Local\Temp\\Patch.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4228

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\ESPI11.dll

          Filesize

          120KB

          MD5

          c3adbb35a05b44bc877a895d273aa270

          SHA1

          8afe20d8261d217fd23ccfe53bd45ad3bec82d2d

          SHA256

          b2b2ea9737587313d420bde96a42063c002a83e35d9f987f8ec0d5d4d96c262c

          SHA512

          614dc24e3368047d68e2833ecdf9cda1f5ef290fc74287769a70df46bfa937386ce2e1332b3bada0f7e54b470ecdfe7c8bbd4ec3fa1c815f52993bb7edb93afc

        • C:\Users\Admin\AppData\Local\Temp\ESPI11.dll

          Filesize

          120KB

          MD5

          c3adbb35a05b44bc877a895d273aa270

          SHA1

          8afe20d8261d217fd23ccfe53bd45ad3bec82d2d

          SHA256

          b2b2ea9737587313d420bde96a42063c002a83e35d9f987f8ec0d5d4d96c262c

          SHA512

          614dc24e3368047d68e2833ecdf9cda1f5ef290fc74287769a70df46bfa937386ce2e1332b3bada0f7e54b470ecdfe7c8bbd4ec3fa1c815f52993bb7edb93afc

        • C:\Users\Admin\AppData\Local\Temp\ESPI11.dll

          Filesize

          120KB

          MD5

          c3adbb35a05b44bc877a895d273aa270

          SHA1

          8afe20d8261d217fd23ccfe53bd45ad3bec82d2d

          SHA256

          b2b2ea9737587313d420bde96a42063c002a83e35d9f987f8ec0d5d4d96c262c

          SHA512

          614dc24e3368047d68e2833ecdf9cda1f5ef290fc74287769a70df46bfa937386ce2e1332b3bada0f7e54b470ecdfe7c8bbd4ec3fa1c815f52993bb7edb93afc

        • C:\Users\Admin\AppData\Local\Temp\Patch.exe

          Filesize

          6.1MB

          MD5

          757d9e9d11e35d3763c07743fcc6e7ed

          SHA1

          2037c66cac11ab802065c4dcac9866d74bab41c5

          SHA256

          0ec52b0bd46c831fbc7dc9dd2164f9821c16009dafd6c4191053420838f18637

          SHA512

          1f7029fdea1a135a3f2944a6f25c50897f494ebf437fadb4600c05c83c2bb75dad36b00a77ff5d231cbe6e3ffb8f2c02c8eb4b496f56719736f9ebd7482fbeb1

        • C:\Users\Admin\AppData\Local\Temp\Patch.exe

          Filesize

          6.1MB

          MD5

          757d9e9d11e35d3763c07743fcc6e7ed

          SHA1

          2037c66cac11ab802065c4dcac9866d74bab41c5

          SHA256

          0ec52b0bd46c831fbc7dc9dd2164f9821c16009dafd6c4191053420838f18637

          SHA512

          1f7029fdea1a135a3f2944a6f25c50897f494ebf437fadb4600c05c83c2bb75dad36b00a77ff5d231cbe6e3ffb8f2c02c8eb4b496f56719736f9ebd7482fbeb1

        • C:\Windows\SysWOW64\ESPI11.dll

          Filesize

          120KB

          MD5

          c3adbb35a05b44bc877a895d273aa270

          SHA1

          8afe20d8261d217fd23ccfe53bd45ad3bec82d2d

          SHA256

          b2b2ea9737587313d420bde96a42063c002a83e35d9f987f8ec0d5d4d96c262c

          SHA512

          614dc24e3368047d68e2833ecdf9cda1f5ef290fc74287769a70df46bfa937386ce2e1332b3bada0f7e54b470ecdfe7c8bbd4ec3fa1c815f52993bb7edb93afc

        • memory/3520-2-0x0000000000400000-0x0000000001939000-memory.dmp

          Filesize

          21.2MB

        • memory/3520-1-0x0000000000400000-0x0000000001939000-memory.dmp

          Filesize

          21.2MB

        • memory/3520-0-0x0000000001AA0000-0x0000000001AA1000-memory.dmp

          Filesize

          4KB

        • memory/3520-48-0x0000000000400000-0x0000000001939000-memory.dmp

          Filesize

          21.2MB

        • memory/4228-18-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

          Filesize

          4KB

        • memory/4228-25-0x0000000002C90000-0x0000000002C91000-memory.dmp

          Filesize

          4KB

        • memory/4228-22-0x0000000002C70000-0x0000000002C71000-memory.dmp

          Filesize

          4KB

        • memory/4228-27-0x0000000000400000-0x0000000000EF0000-memory.dmp

          Filesize

          10.9MB

        • memory/4228-24-0x0000000002C80000-0x0000000002C81000-memory.dmp

          Filesize

          4KB

        • memory/4228-23-0x0000000000400000-0x0000000000EF0000-memory.dmp

          Filesize

          10.9MB

        • memory/4228-21-0x0000000002C60000-0x0000000002C61000-memory.dmp

          Filesize

          4KB

        • memory/4228-44-0x0000000000400000-0x0000000000EF0000-memory.dmp

          Filesize

          10.9MB

        • memory/4228-20-0x0000000001090000-0x0000000001091000-memory.dmp

          Filesize

          4KB

        • memory/4228-19-0x0000000001080000-0x0000000001081000-memory.dmp

          Filesize

          4KB