13e67849abf157561e8bf9017ce856310fe757e1508221ace9645ce85374e95e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6c9a4829e467a8303a6156d3e9e2680d
Size

197KB
Sample

231226-n41wzsgbak
MD5

6c9a4829e467a8303a6156d3e9e2680d
SHA1

2270828db581bbd7513cafb0bc0374ea66998a13
SHA256

13e67849abf157561e8bf9017ce856310fe757e1508221ace9645ce85374e95e
SHA512

4794f720eb7585bb3064ba4159c3b6063b40251e11e9471d3be425f4cd491fca60b147328cd2ecfe63d3a6650be769852e0adebedd893aecc94a8b00e39b6a78
SSDEEP

3072:SEPl19U+pzDsZbbGs4SVhfGsysaro7YRl4hWUGjLpbenenbj:Sm19UMzQZbbGshVhfGscLRlqWrfte8

Score

10^/10

evasion trojan vmprotect

Malware Config

Targets

- Target
  
  6c9a4829e467a8303a6156d3e9e2680d
- Size
  
  197KB
- MD5
  
  6c9a4829e467a8303a6156d3e9e2680d
- SHA1
  
  2270828db581bbd7513cafb0bc0374ea66998a13
- SHA256
  
  13e67849abf157561e8bf9017ce856310fe757e1508221ace9645ce85374e95e
- SHA512
  
  4794f720eb7585bb3064ba4159c3b6063b40251e11e9471d3be425f4cd491fca60b147328cd2ecfe63d3a6650be769852e0adebedd893aecc94a8b00e39b6a78
- SSDEEP
  
  3072:SEPl19U+pzDsZbbGs4SVhfGsysaro7YRl4hWUGjLpbenenbj:Sm19UMzQZbbGshVhfGscLRlqWrfte8
Score

10^/10

evasion trojan vmprotect
- UAC bypass
  evasion trojan
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasiontrojanvmprotect

behavioral2

evasiontrojanvmprotect