Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 00:21

General

  • Target

    34db792b967c14136b90f68945f1eb3b.exe

  • Size

    6.0MB

  • MD5

    34db792b967c14136b90f68945f1eb3b

  • SHA1

    2f8d743fff74a46467776050b7ae27c118c6502e

  • SHA256

    d57cbbe1dffc12f734c4b3dc4c87b65daa83bc651c4d513f2f9643c6614e1639

  • SHA512

    5ea85f17bc8f690bb1910dee66fc313fa239e420e8abc952eaa621d50fb860584677be7958fe3a0e74d2a49f2e33d4a73d4715baaec9da61f0d2b78fdb47f0ec

  • SSDEEP

    98304:6wv9G12w5d/u5A5tfznVl8233OSVbKjjeFdJ/1uxMuNfp8MHNIMELACpokDWyqr5:6w22mUA5tfplduymjjezJtCMQBdH2MEC

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34db792b967c14136b90f68945f1eb3b.exe
    "C:\Users\Admin\AppData\Local\Temp\34db792b967c14136b90f68945f1eb3b.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2252

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2252-11-0x000000013F190000-0x000000013FC01000-memory.dmp

          Filesize

          10.4MB

        • memory/2252-10-0x00000000774E0000-0x00000000774E2000-memory.dmp

          Filesize

          8KB

        • memory/2252-13-0x0000000077320000-0x00000000774C9000-memory.dmp

          Filesize

          1.7MB

        • memory/2252-17-0x0000000077320000-0x00000000774C9000-memory.dmp

          Filesize

          1.7MB

        • memory/2252-16-0x000000013F190000-0x000000013FC01000-memory.dmp

          Filesize

          10.4MB

        • memory/2252-8-0x00000000774E0000-0x00000000774E2000-memory.dmp

          Filesize

          8KB

        • memory/2252-6-0x00000000774E0000-0x00000000774E2000-memory.dmp

          Filesize

          8KB

        • memory/2252-5-0x00000000774D0000-0x00000000774D2000-memory.dmp

          Filesize

          8KB

        • memory/2252-3-0x00000000774D0000-0x00000000774D2000-memory.dmp

          Filesize

          8KB

        • memory/2252-1-0x00000000774D0000-0x00000000774D2000-memory.dmp

          Filesize

          8KB

        • memory/2252-0-0x000000013F190000-0x000000013FC01000-memory.dmp

          Filesize

          10.4MB