3422b33a307f80a5dad2882982e061d1ed496f7a1b5c6541fdde8cbab133af7a

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 23:42

Target

1a69935073fb2ff90d74e75428854bf8.exe
Size

1.9MB
MD5

1a69935073fb2ff90d74e75428854bf8
SHA1

41abbb5100a64a9637cd5af6b678902baf731013
SHA256

3422b33a307f80a5dad2882982e061d1ed496f7a1b5c6541fdde8cbab133af7a
SHA512

cdf36b6ce52de3447154d64d3c3d180b8a540f51d2c60cac1bd04b440e51c1050cbb16a15935ffc5c1c2b93b0a4c3d26c0278c612f6171835b09bc650342538b
SSDEEP

49152:3eSgHKhG7DuyiTDi+EjIJo54clgLH+tkWJ0:upq47DfsibIFcKHgkWJ0

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1700-0-0x00000000009A0000-0x0000000000CB4000-memory.dmp	vmprotect

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1a69935073fb2ff90d74e75428854bf8.exe

description pid process

Token: SeDebugPrivilege 1700 1a69935073fb2ff90d74e75428854bf8.exe

flow	ioc
2	api.ipify.org
3	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	1700	1a69935073fb2ff90d74e75428854bf8.exe

C:\Users\Admin\AppData\Local\Temp\1a69935073fb2ff90d74e75428854bf8.exe
"C:\Users\Admin\AppData\Local\Temp\1a69935073fb2ff90d74e75428854bf8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700

memory/1700-0-0x00000000009A0000-0x0000000000CB4000-memory.dmp

Filesize
3.1MB

Download
memory/1700-1-0x000007FEF5840000-0x000007FEF622C000-memory.dmp

Filesize
9.9MB

Download
memory/1700-4-0x00000000004A0000-0x0000000000520000-memory.dmp

Filesize
512KB

Download
memory/1700-5-0x00000000004A0000-0x0000000000520000-memory.dmp

Filesize
512KB

Download
memory/1700-3-0x00000000004A0000-0x0000000000520000-memory.dmp

Filesize
512KB

Download
memory/1700-2-0x00000000004A0000-0x0000000000520000-memory.dmp

Filesize
512KB

Download
memory/1700-6-0x000000001B7F0000-0x000000001B866000-memory.dmp

Filesize
472KB

Download
memory/1700-7-0x000007FEF5840000-0x000007FEF622C000-memory.dmp

Filesize
9.9MB

Download