1d29a82f343372d9ccc7ecd56d49b03b5dfcc2afb654de212c7fff5c67085f13

General

Target

ff03cb1d0fddde80c681ae5fe7ea2119.exe
Size

5.9MB
MD5

ff03cb1d0fddde80c681ae5fe7ea2119
SHA1

5f8a72a358608c1e650c4196ae3d9ffe498b1087
SHA256

1d29a82f343372d9ccc7ecd56d49b03b5dfcc2afb654de212c7fff5c67085f13
SHA512

0137c3ad8e8f5f72a4cda693b7a43e94d8941c2c2cdff79d0da5b6e310bba7edb7ea04a333fca4d233a92ede731e870a2bcee8f2663b8b69d49d95454d983902
SSDEEP

98304:yHZt5ZGYRjCQuTGOkb9uj5PPY3KuG7GJ9TYKdnSYL2wqcKCBYHDRJ/2LSH:Itl8TZP5oKuG7GJGKddL2wZdW1JDH

Score

7^/10

vmprotect

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2592	XRJNZC.exe
1644	XRJNZC.exe
2432	XRJNZC.exe

Loads dropped DLL 1 IoCs

pid	Process
2932	cmd.exe

VMProtect packed file 12 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2852-3-0x0000000000390000-0x0000000000EAB000-memory.dmp	vmprotect
behavioral1/memory/2852-7-0x0000000000390000-0x0000000000EAB000-memory.dmp	vmprotect
behavioral1/memory/2852-37-0x0000000000390000-0x0000000000EAB000-memory.dmp	vmprotect
behavioral1/memory/2852-50-0x0000000000390000-0x0000000000EAB000-memory.dmp	vmprotect
behavioral1/files/0x000a000000012251-51.dat	vmprotect
behavioral1/memory/2592-57-0x0000000000D50000-0x000000000186B000-memory.dmp	vmprotect
behavioral1/memory/2592-61-0x0000000000D50000-0x000000000186B000-memory.dmp	vmprotect
behavioral1/memory/2592-93-0x0000000000D50000-0x000000000186B000-memory.dmp	vmprotect
behavioral1/memory/1644-97-0x0000000000D50000-0x000000000186B000-memory.dmp	vmprotect
behavioral1/memory/1644-133-0x0000000000D50000-0x000000000186B000-memory.dmp	vmprotect
behavioral1/memory/2432-137-0x0000000000D50000-0x000000000186B000-memory.dmp	vmprotect
behavioral1/memory/2432-173-0x0000000000D50000-0x000000000186B000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2756	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2748	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2852	ff03cb1d0fddde80c681ae5fe7ea2119.exe
2592	XRJNZC.exe
1644	XRJNZC.exe
2432	XRJNZC.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2932	2852	ff03cb1d0fddde80c681ae5fe7ea2119.exe	28
PID 2852 wrote to memory of 2932	2852	ff03cb1d0fddde80c681ae5fe7ea2119.exe	28
PID 2852 wrote to memory of 2932	2852	ff03cb1d0fddde80c681ae5fe7ea2119.exe	28
PID 2852 wrote to memory of 2932	2852	ff03cb1d0fddde80c681ae5fe7ea2119.exe	28
PID 2932 wrote to memory of 2748	2932	cmd.exe	30
PID 2932 wrote to memory of 2748	2932	cmd.exe	30
PID 2932 wrote to memory of 2748	2932	cmd.exe	30
PID 2932 wrote to memory of 2748	2932	cmd.exe	30
PID 2932 wrote to memory of 2592	2932	cmd.exe	31
PID 2932 wrote to memory of 2592	2932	cmd.exe	31
PID 2932 wrote to memory of 2592	2932	cmd.exe	31
PID 2932 wrote to memory of 2592	2932	cmd.exe	31
PID 2592 wrote to memory of 2756	2592	XRJNZC.exe	32
PID 2592 wrote to memory of 2756	2592	XRJNZC.exe	32
PID 2592 wrote to memory of 2756	2592	XRJNZC.exe	32
PID 2592 wrote to memory of 2756	2592	XRJNZC.exe	32
PID 932 wrote to memory of 1644	932	taskeng.exe	37
PID 932 wrote to memory of 1644	932	taskeng.exe	37
PID 932 wrote to memory of 1644	932	taskeng.exe	37
PID 932 wrote to memory of 1644	932	taskeng.exe	37
PID 932 wrote to memory of 2432	932	taskeng.exe	38
PID 932 wrote to memory of 2432	932	taskeng.exe	38
PID 932 wrote to memory of 2432	932	taskeng.exe	38
PID 932 wrote to memory of 2432	932	taskeng.exe	38

C:\Users\Admin\AppData\Local\Temp\ff03cb1d0fddde80c681ae5fe7ea2119.exe
"C:\Users\Admin\AppData\Local\Temp\ff03cb1d0fddde80c681ae5fe7ea2119.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\s278.0.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2748
- - C:\ProgramData\pinterests\XRJNZC.exe
    "C:\ProgramData\pinterests\XRJNZC.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "XRJNZC" /tr C:\ProgramData\pinterests\XRJNZC.exe /f
      4⤵
      Creates scheduled task(s)
      PID:2756

C:\Windows\system32\taskeng.exe
taskeng.exe {EF21717C-8F81-4964-B16A-38DAB56BC707} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\ProgramData\pinterests\XRJNZC.exe
  C:\ProgramData\pinterests\XRJNZC.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\ProgramData\pinterests\XRJNZC.exe
  C:\ProgramData\pinterests\XRJNZC.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\s278.0.bat

Filesize
176B

MD5
d300b5940a86d10339f5578b9dc749ff

SHA1
b64d1825d2bea9cc82c69e77c6a29f968ea6c585

SHA256
cc233118d0f72d2f7b49f85c92b5984ea383e0025aaefb13c448e086d566f9e3

SHA512
68ef47e24db4ed4a8e5cd95982a8a252997535440cf8d067f749a4c28aa33dd8ed0a65c75d12b95d76e8b2cbeb96d918e319f32075d771061729bf4de7d8f8cc

Download Submit
\ProgramData\pinterests\XRJNZC.exe

Filesize
5.9MB

MD5
ff03cb1d0fddde80c681ae5fe7ea2119

SHA1
5f8a72a358608c1e650c4196ae3d9ffe498b1087

SHA256
1d29a82f343372d9ccc7ecd56d49b03b5dfcc2afb654de212c7fff5c67085f13

SHA512
0137c3ad8e8f5f72a4cda693b7a43e94d8941c2c2cdff79d0da5b6e310bba7edb7ea04a333fca4d233a92ede731e870a2bcee8f2663b8b69d49d95454d983902

Download Submit
memory/1644-133-0x0000000000D50000-0x000000000186B000-memory.dmp

Filesize
11.1MB

Download
memory/1644-97-0x0000000000D50000-0x000000000186B000-memory.dmp

Filesize
11.1MB

Download
memory/2432-173-0x0000000000D50000-0x000000000186B000-memory.dmp

Filesize
11.1MB

Download
memory/2432-137-0x0000000000D50000-0x000000000186B000-memory.dmp

Filesize
11.1MB

Download
memory/2592-80-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2592-78-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2592-68-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2592-70-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2592-73-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2592-75-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2592-65-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2592-63-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2592-61-0x0000000000D50000-0x000000000186B000-memory.dmp

Filesize
11.1MB

Download
memory/2592-59-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2592-56-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2592-93-0x0000000000D50000-0x000000000186B000-memory.dmp

Filesize
11.1MB

Download
memory/2592-57-0x0000000000D50000-0x000000000186B000-memory.dmp

Filesize
11.1MB

Download
memory/2852-16-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2852-50-0x0000000000390000-0x0000000000EAB000-memory.dmp

Filesize
11.1MB

Download
memory/2852-37-0x0000000000390000-0x0000000000EAB000-memory.dmp

Filesize
11.1MB

Download
memory/2852-31-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2852-29-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2852-26-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2852-24-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2852-21-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2852-19-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2852-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2852-14-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2852-11-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2852-9-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2852-6-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2852-7-0x0000000000390000-0x0000000000EAB000-memory.dmp

Filesize
11.1MB

Download
memory/2852-5-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2852-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2852-3-0x0000000000390000-0x0000000000EAB000-memory.dmp

Filesize
11.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads