75e55e9b8bcac7b87bb2f9dffbf8e8912d1bab22bdb8eee607393a7ec98dd426

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

41ede649f7f7803d50ba9f2970547814.exe
Size

199KB
MD5

41ede649f7f7803d50ba9f2970547814
SHA1

3e35d0148c5b79ae803b179e8573b2cc4e27c151
SHA256

75e55e9b8bcac7b87bb2f9dffbf8e8912d1bab22bdb8eee607393a7ec98dd426
SHA512

a2f93f4229e96a27ca6df54264668bdf5ab34968531190dc80869ab45e2c03a6ca97621c225c7852ec59421619c769d9eb269483fce075e74aceb802c6e4b905
SSDEEP

1536:N6Ts45iiaX/b3ysiij9AxtmZlow/7ZKNE8NPBRjezSnk4sV6/J+20:W3UDvusiOAxtaln/7ZgPB82k4S6/J+7

Score

7^/10

persistence vmprotect

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2180	cmd.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2028-0-0x0000000000400000-0x0000000000420000-memory.dmp	vmprotect
behavioral1/memory/2028-2-0x0000000000400000-0x0000000000420000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\stubpath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apple.exe"	41ede649f7f7803d50ba9f2970547814.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2180	2028	41ede649f7f7803d50ba9f2970547814.exe	32
PID 2028 wrote to memory of 2180	2028	41ede649f7f7803d50ba9f2970547814.exe	32
PID 2028 wrote to memory of 2180	2028	41ede649f7f7803d50ba9f2970547814.exe	32
PID 2028 wrote to memory of 2180	2028	41ede649f7f7803d50ba9f2970547814.exe	32

C:\Users\Admin\AppData\Local\Temp\41ede649f7f7803d50ba9f2970547814.exe
"C:\Users\Admin\AppData\Local\Temp\41ede649f7f7803d50ba9f2970547814.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\1.bat
  2⤵
  - Deletes itself
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.bat

Filesize
133B

MD5
8a984a556fa716c46e4a15eb9d9ce9de

SHA1
b5de5327df7c5df7b1f9a1bcd891a3a4bddb52ce

SHA256
9539ebc26a0c5e75754996c629c71936c8c1c6078aa8e87343f256d114063ed8

SHA512
ac4e3b9c952137841343b227d271e71ae94d8e7b8b30b18ff8ed45a51a0291464f72e4ad48b2ab2364e8bff97ecfc1d2c1d85985f68c8373c89155825c0e68c1

Download Submit
memory/2028-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2028-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads