Malware Analysis Report

2025-08-05 21:25

Sample ID 231220-t78c5ahad9
Target ebae09af0151622f220b7ee8064888d3
SHA256 84d08bdfdf8412eb1991c35edc00539d55634d9f994af7bb8830deb103da64a9
Tags
vmprotect
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

84d08bdfdf8412eb1991c35edc00539d55634d9f994af7bb8830deb103da64a9

Threat Level: Shows suspicious behavior

The file ebae09af0151622f220b7ee8064888d3 was found to be: Shows suspicious behavior.

Malicious Activity Summary

vmprotect

Loads dropped DLL

VMProtect packed file

Executes dropped EXE

Maps connected drives based on registry

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Unsigned PE

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-20 16:43

Signatures

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-20 16:43

Reported

2023-12-22 13:22

Platform

win7-20231215-en

Max time kernel

121s

Max time network

126s

Command Line

C:\Windows\Explorer.EXE

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SCBYDL\y6j0nqP.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
N/A N/A C:\Windows\SCBYDL\y6j0nqP.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Windows\Explorer.EXE N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\Explorer.EXE N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\lz_scby.txt C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
File created \??\c:\windows\SysWOW64\lz_scby.txt C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
N/A N/A C:\Windows\SCBYDL\y6j0nqP.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\SCBYDL\qY1kvol.dll C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
File created C:\Windows\SCBYDL\y6j0nqP.exe C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
File opened for modification C:\Windows\r0kdt\ C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\SCBYDL\ C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
File created C:\Windows\SCBYDL\25badd61d366786808b6eebb3279cb77 C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SCBYDL\y6j0nqP.exe N/A
Token: 33 N/A C:\Windows\Explorer.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: 33 N/A C:\Windows\Explorer.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe

"C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe"

C:\Windows\SCBYDL\y6j0nqP.exe

C:/Windows/SCBYDL/y6j0nqP.exe /runp2p:C:/Windows/SCBYDL/qY1kvol.dll

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.baidu.com udp
US 8.8.8.8:53 np2p.soomeng.com udp
N/A 104.193.88.123:0 icmp
US 8.8.8.8:53 np2p.inibin.com udp
US 172.121.63.157:80 np2p.inibin.com tcp

Files

memory/1104-0-0x0000000000960000-0x0000000000CC7000-memory.dmp

memory/1104-1-0x00000000773D0000-0x00000000773D1000-memory.dmp

memory/1104-3-0x00000000773D0000-0x00000000773D1000-memory.dmp

memory/1104-7-0x00000000765C0000-0x00000000765C1000-memory.dmp

memory/1104-9-0x0000000000960000-0x0000000000CC7000-memory.dmp

memory/1104-13-0x00000000001C0000-0x000000000021B000-memory.dmp

memory/1104-14-0x00000000001C0000-0x000000000021B000-memory.dmp

\Windows\SCBYDL\y6j0nqP.exe

MD5 ccbea67ee342fde7b1de67fb61893c2c
SHA1 5d7d97f6984777c98df8641318c358eb2900c3f5
SHA256 e1f01d5c7a8f79d23c2d1712550f023ff6aae46bdf71706207c12bdc3fe2b43a
SHA512 dfaf7eec7be52129e219ee4198e7cf4ec7df26cb16f6475a376c87bc675a1e8c24dfa96aa627a040438f2dbfba44dea68128fc9608c18f13bfc61dfe4e149168

memory/1104-19-0x00000000020D0000-0x000000000214A000-memory.dmp

memory/1900-23-0x000000013F620000-0x000000013F69A000-memory.dmp

memory/1900-24-0x000000013F620000-0x000000013F69A000-memory.dmp

C:\Windows\SCBYDL\qY1kvol.dll

MD5 f4d4634139afe2087f0ba70cf32f74cc
SHA1 e88254f950a79faddf0c544eb0a5213c4ea50c9f
SHA256 b76df6b289e782ad1a2809ebcb9ed168a1c19716a9bf5e3c13cae6a6060b7c7f
SHA512 14fd67765eb9ee78fd7adf22fe38d72206ebc4624ca15e91a49151db3e62d0526cb2a24d656c9892d09d363efe0918177e806e69712ac4fe7d07953c2a0c6265

memory/1392-28-0x0000000002220000-0x0000000002221000-memory.dmp

memory/1392-31-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1392-32-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1392-33-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1900-35-0x000000013F620000-0x000000013F69A000-memory.dmp

memory/1104-36-0x0000000000960000-0x0000000000CC7000-memory.dmp

memory/1104-37-0x00000000001C0000-0x000000000021B000-memory.dmp

C:\Windows\SCBYDL\25badd61d366786808b6eebb3279cb77

MD5 bceb1ecffcd443b74373ab8246c967fe
SHA1 6948c163e51917c9554dfbcd72452519aac30699
SHA256 b876b09556182b70742295de334e31d5007326259942b53d87139ef3bd05465f
SHA512 f6d7838df083d43ad0c3c94fe361389fa5adfe91c01caa4ed68196482474c8fc410e4ff4d49bbea2e29d4a3b8bfefbb854ec45b47b1a3043f3ffb6400b02cd41

memory/1392-39-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1392-40-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1392-41-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1392-43-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1392-44-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1392-45-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1392-46-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1392-47-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1392-48-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1392-49-0x0000000003A20000-0x0000000003A86000-memory.dmp

memory/1392-50-0x0000000003A20000-0x0000000003A86000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-20 16:43

Reported

2023-12-22 13:23

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SCBYDL\emPcTW9.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SCBYDL\emPcTW9.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Windows\Explorer.EXE N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Windows\Explorer.EXE N/A

Drops file in System32 directory

Description Indicator Process Target
File created \??\c:\windows\SysWOW64\lz_scby.txt C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
File opened for modification \??\c:\windows\SysWOW64\lz_scby.txt C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
N/A N/A C:\Windows\SCBYDL\emPcTW9.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SCBYDL\ C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
File created C:\Windows\SCBYDL\cacca45129260643620919a9e451f8a3 C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
File created C:\Windows\SCBYDL\w2hQBUR.dll C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
File created C:\Windows\SCBYDL\emPcTW9.exe C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe N/A
File opened for modification C:\Windows\xS2Vp\ C:\Windows\Explorer.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SCBYDL\emPcTW9.exe N/A
Token: 33 N/A C:\Windows\Explorer.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: 33 N/A C:\Windows\Explorer.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4856 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe C:\Windows\SCBYDL\emPcTW9.exe
PID 4856 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe C:\Windows\SCBYDL\emPcTW9.exe
PID 1464 wrote to memory of 3420 N/A C:\Windows\SCBYDL\emPcTW9.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe

"C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe"

C:\Windows\SCBYDL\emPcTW9.exe

C:/Windows/SCBYDL/emPcTW9.exe /runp2p:C:/Windows/SCBYDL/w2hQBUR.dll

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 82.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 www.baidu.com udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 np2p.soomeng.com udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
N/A 104.193.88.77:0 icmp
US 8.8.8.8:53 np2p.inibin.com udp
US 172.121.63.157:80 np2p.inibin.com tcp
US 8.8.8.8:53 157.63.121.172.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 61.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp

Files

memory/4856-0-0x00000000007E0000-0x0000000000B47000-memory.dmp

memory/4856-1-0x00000000007E0000-0x0000000000B47000-memory.dmp

memory/4856-6-0x0000000003960000-0x00000000039BB000-memory.dmp

memory/4856-5-0x0000000003960000-0x00000000039BB000-memory.dmp

C:\Windows\SCBYDL\emPcTW9.exe

MD5 de3d19dde816cca8943d098c861ceb43
SHA1 a1365f8840277050e75ab9b6078859dcfd91840b
SHA256 412d08e4c7ae96db0a6e252cdd2e592479388b652e3c88b06563a4b2dd3c956e
SHA512 cf9586ae84d9eaa8eca90361ab71348d8a6a1b647f32793ec8ee207d001e6b477d3da2eac476c51d457298412976b19215d7e62036baead524fea74d74756497

C:\Windows\SCBYDL\emPcTW9.exe

MD5 6d94f59e751c69a34b63fa1cd818fd93
SHA1 9cd28e1e4b0292e6bb7bad2240e3db580f01c06b
SHA256 fc434b3493c84a95942d919bb3cf089aee24dae928e55801340f392c1d7b7750
SHA512 f87e658ad110c530571605797cce7307f8c5d8f86004d4986d11523ee233671a89597e34c20e7680440428858251b7a877aa753b8c7ca95e4947d789235877e0

memory/1464-14-0x00007FF674230000-0x00007FF6742AA000-memory.dmp

C:\Windows\SCBYDL\w2hQBUR.dll

MD5 d5bb07276776da60f878cea5128f20d0
SHA1 2d9346b2d6ca0599ab6b994b650fe0a47a992a4a
SHA256 a84f4465d022efb5e77089066de6ca04058d892edf6a98e32f3a25b3f1fd17f2
SHA512 0a3f306ad7293849a49aef5747594c6a3f5a4ed6e16be6b63fd67a1e59bca10b2dd414059215e8a3773365308404c63c12849464645e337821e002408dc7a159

memory/1464-12-0x00007FF674230000-0x00007FF6742AA000-memory.dmp

C:\Windows\SCBYDL\w2hQBUR.dll

MD5 f209c15dbe40df760950815d568ceb41
SHA1 99108c048829f3091a56deb6ba0cdd7a9665cda8
SHA256 b025eb3b48b85c8596e074adea513ffaf9c84b462aafae47d4a61f3972b936cf
SHA512 73120e710501b28e22a6b7e1d060083f0de87176d567eb509ab780438c33487b0f97daccae9fd8228a135d7bf7b7c66f490d636bfd4024feb093b994c790fa3c

memory/3420-21-0x0000000002870000-0x00000000028D6000-memory.dmp

memory/4856-24-0x00000000007E0000-0x0000000000B47000-memory.dmp

memory/1464-22-0x00007FF674230000-0x00007FF6742AA000-memory.dmp

memory/3420-19-0x0000000002870000-0x00000000028D6000-memory.dmp

C:\Windows\SCBYDL\w2hQBUR.dll

MD5 6cfaacc0bfa820a97654c88d357ce002
SHA1 2fa2991b6b2cd6063843b5748d0b7cdf1a42505c
SHA256 4ee493d20adb4fa7eb58d0ac5a83a6165094aa97729ca6f14804fee2c4115716
SHA512 6a0ccd4ac635d7f9de8cd3b28c56e24716cd66a9b373763a98942ecc8869ddae3f2f399a1fc3ea6c48cbec465c61a0fd14827a85003fbc36f75d7178fc817d6c

memory/4856-25-0x0000000003960000-0x00000000039BB000-memory.dmp

memory/3420-27-0x0000000002870000-0x00000000028D6000-memory.dmp

memory/3420-28-0x0000000002870000-0x00000000028D6000-memory.dmp

C:\Windows\SCBYDL\cacca45129260643620919a9e451f8a3

MD5 23941cd38ad33bd42f149f90d3fd4cc0
SHA1 db169b2db5da6590965c48d573a4036fdedce564
SHA256 d2eb0c5eff5caa20023871dd779bb6406efda880d8743d27bc2be46d2a854cc8
SHA512 67447a26152242b38194e2aab51bbdfd377a2af774a89ce801ac6fc7e15353027859c7edcce3ed3a86268c606a9213f9c9124eede60e1b62171322d3e0c60b2d

memory/3420-29-0x0000000002870000-0x00000000028D6000-memory.dmp

memory/3420-32-0x0000000002870000-0x00000000028D6000-memory.dmp

memory/3420-33-0x0000000002870000-0x00000000028D6000-memory.dmp

memory/3420-35-0x0000000002870000-0x00000000028D6000-memory.dmp

memory/3420-34-0x0000000002870000-0x00000000028D6000-memory.dmp

memory/3420-31-0x0000000002870000-0x00000000028D6000-memory.dmp

memory/3420-37-0x0000000002870000-0x00000000028D6000-memory.dmp

memory/3420-36-0x0000000002870000-0x00000000028D6000-memory.dmp

memory/3420-38-0x0000000002870000-0x00000000028D6000-memory.dmp