Analysis
- max time kernel
145s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
24/12/2023, 14:34
General
- Target 014653d6b17f29083cbb62debb2993fc.exe
- Size 8.6MB
- Sample231224-rxnvmafffk
- SHA256 c8a40e8a075c7702f16de499dadbe7a8f437579eef39cf980835d111c8cdf173
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- VMProtect packed file 8 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\014653d6b17f29083cbb62debb2993fc.exe"C:\Users\Admin\AppData\Local\Temp\014653d6b17f29083cbb62debb2993fc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\krprfydrknxlurnqtfmmanurnutroptjrbqoxurzmixnfqiuor.bqbtxfcsqmC:\Users\Admin\AppData\Local\Temp\krprfydrknxlurnqtfmmanurnutroptjrbqoxurzmixnfqiuor.bqbtxfcsqm C:\Users\Admin\AppData\Local\Temp\014653d6b17f29083cbb62debb2993fc.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
TuTuchk.ini
krprfydrknxlurnqtfmmanurnutroptjrbqoxurzmixnfqiuor.bqbtxfcsqm
krprfydrknxlurnqtfmmanurnutroptjrbqoxurzmixnfqiuor.bqbtxfcsqm
memory/2992-0-0x0000000000400000-0x00000000015DA000-memory.dmp
memory/2992-3-0x0000000000400000-0x00000000015DA000-memory.dmp
memory/2992-5-0x00000000774E0000-0x00000000774E1000-memory.dmp
memory/2992-4-0x0000000075E80000-0x0000000075E81000-memory.dmp
memory/2992-14-0x0000000000400000-0x00000000015DA000-memory.dmp
memory/3452-10-0x0000000000400000-0x00000000015DA000-memory.dmp
memory/3452-12-0x0000000000400000-0x00000000015DA000-memory.dmp
memory/3452-24-0x0000000000400000-0x00000000015DA000-memory.dmp