d3c9d0ce3159231ca3ebdb31635b0e181940acd6042ede056170816f6ed9957e

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f7e8ee00d9afe114e83f30b5c8d2d736.exe
Size

6.1MB
MD5

f7e8ee00d9afe114e83f30b5c8d2d736
SHA1

02638d17b629faa222da4bc78e822cade3a23f65
SHA256

d3c9d0ce3159231ca3ebdb31635b0e181940acd6042ede056170816f6ed9957e
SHA512

f7dff2a5801de127511c79477d52899886de139d12a000abf90c49e8aa6af29a0799c2abffe6bedd5d0e54e686c2966282a82a47c646f43d8e6cff6d0ad2258e
SSDEEP

98304:mb+C0zGN52Je8hLbH9XKDqH9uKJoLKUZnxUfihsZaJhxrkmjMBITPES:QV0zpThLr1KAixOfMsZCMIo

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2228-2-0x0000000000400000-0x000000000161D000-memory.dmp	vmprotect
behavioral1/memory/2228-6-0x0000000000400000-0x000000000161D000-memory.dmp	vmprotect
behavioral1/memory/2228-61-0x0000000000400000-0x000000000161D000-memory.dmp	vmprotect
behavioral1/memory/2228-62-0x0000000000400000-0x000000000161D000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2228	f7e8ee00d9afe114e83f30b5c8d2d736.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2228	f7e8ee00d9afe114e83f30b5c8d2d736.exe
2228	f7e8ee00d9afe114e83f30b5c8d2d736.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2228	f7e8ee00d9afe114e83f30b5c8d2d736.exe
2228	f7e8ee00d9afe114e83f30b5c8d2d736.exe
2228	f7e8ee00d9afe114e83f30b5c8d2d736.exe

C:\Users\Admin\AppData\Local\Temp\f7e8ee00d9afe114e83f30b5c8d2d736.exe
"C:\Users\Admin\AppData\Local\Temp\f7e8ee00d9afe114e83f30b5c8d2d736.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Sink.ini

Filesize
29B

MD5
67852ce04bf540e017501c677773205b

SHA1
00f5b0a0bbc4f4292f1f2957d2facd34576c28bc

SHA256
ac3c85213a63c4d23134ce0c91efc4828578afc2b596ecc0b24c487dddb17bc7

SHA512
ceb9872229829cb56edd4d5cee5bf4eb37fddcb7e130e69063aaba3fbb5c4186f19afd0d3c542512a624918893cd834e83d4b594720a2a3971052e7fb8120292

Download Submit
memory/2228-29-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2228-32-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2228-6-0x0000000000400000-0x000000000161D000-memory.dmp

Filesize
18.1MB

Download
memory/2228-7-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2228-5-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2228-11-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2228-9-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2228-14-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2228-16-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2228-26-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2228-24-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2228-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2228-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2228-19-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2228-31-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2228-41-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2228-39-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2228-37-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2228-43-0x0000000077130000-0x0000000077131000-memory.dmp

Filesize
4KB

Download
memory/2228-36-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2228-34-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2228-21-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2228-2-0x0000000000400000-0x000000000161D000-memory.dmp

Filesize
18.1MB

Download
memory/2228-61-0x0000000000400000-0x000000000161D000-memory.dmp

Filesize
18.1MB

Download
memory/2228-62-0x0000000000400000-0x000000000161D000-memory.dmp

Filesize
18.1MB

Download