Analysis
- max time kernel
141s - max time network
87s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
31/12/2023, 10:17
General
- Target 325cfaf6a3942af25d654ca13cc9f795.exe
- Size 20.9MB
- Sample231231-mbcg9adch8
- SHA256 cc145daee28e88dfb6b51e77a5d9f29152d4da1f5789b2b3a4d8fcb736543e3b
Score
9/10
Malware Config
Signatures
- Detectes Phoenix Miner Payload 1 IoCs
- VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\325cfaf6a3942af25d654ca13cc9f795.exe"C:\Users\Admin\AppData\Local\Temp\325cfaf6a3942af25d654ca13cc9f795.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\scratch.bat2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\PING.EXEping -n 10 127.0.0.11⤵
- Runs ping.exe
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aut6D31.tmp
scratch.bat
memory/3548-0-0x0000000140000000-0x0000000142A34000-memory.dmp
memory/3548-3-0x0000000140000000-0x0000000142A34000-memory.dmp
memory/3548-5-0x00007FF9CBF90000-0x00007FF9CBF91000-memory.dmp
memory/3548-36-0x0000000140000000-0x0000000142A34000-memory.dmp