Analysis
- max time kernel
1s - max time network
128s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
10/01/2024, 01:14
General
- Target ARES_Launcher.exe
- Size 5.1MB
- Sample240110-blz6hsccc6
- SHA256 28846b3e1432fa895ce34212401e0b930e7fd84c3983651274475bb5f80d7d8b
Malware Config
Signatures
- VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ARES_Launcher.exe"C:\Users\Admin\AppData\Local\Temp\ARES_Launcher.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2364-0-0x00000000742D0000-0x00000000749BE000-memory.dmp
memory/2364-1-0x0000000000850000-0x00000000010B8000-memory.dmp
memory/2364-2-0x0000000000580000-0x00000000005C0000-memory.dmp
memory/2364-4-0x00000000005C0000-0x00000000005E6000-memory.dmp
memory/2364-6-0x0000000000610000-0x000000000061C000-memory.dmp
memory/2364-5-0x00000000005F0000-0x0000000000606000-memory.dmp
memory/2364-3-0x00000000003F0000-0x00000000003FE000-memory.dmp
memory/2364-7-0x0000000000660000-0x0000000000668000-memory.dmp
memory/2364-142-0x0000000006390000-0x0000000006442000-memory.dmp
memory/2364-143-0x0000000000810000-0x0000000000818000-memory.dmp
memory/2364-146-0x0000000000830000-0x000000000083A000-memory.dmp
memory/2364-145-0x0000000000830000-0x000000000083A000-memory.dmp
memory/2364-144-0x0000000000580000-0x00000000005C0000-memory.dmp
memory/2364-147-0x0000000000840000-0x000000000084A000-memory.dmp
memory/2364-296-0x00000000013D0000-0x00000000013EC000-memory.dmp
memory/2364-384-0x00000000742D0000-0x00000000749BE000-memory.dmp
memory/2364-386-0x0000000000580000-0x00000000005C0000-memory.dmp
memory/2364-385-0x0000000000580000-0x00000000005C0000-memory.dmp
memory/2364-411-0x0000000000580000-0x00000000005C0000-memory.dmp
memory/2364-412-0x0000000000830000-0x000000000083A000-memory.dmp