Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    10/01/2024, 06:13

General

  • Target

    4fccfed3868ef42c54f33dd7c002bb2c.exe

  • Size

    85KB

  • MD5

    4fccfed3868ef42c54f33dd7c002bb2c

  • SHA1

    9b9aca6c8c3563e8f9f7e5cd3f13459fa334eea0

  • SHA256

    02c198348bbf5ce3b7ee384c5c482a991689e219e21456048b3bc5c64a6a58b6

  • SHA512

    2208a327d77bdc39d790ec63e5fa188a32ee572cf7986de5b8ceaefe67a06a968165eb5efb010e16d02e7d0de6d6e1884b0eb8773797182bb9eed43ecfb263a5

  • SSDEEP

    1536:UHSlUL6555Qmkd74v4rYgXVf3lFnToIfqCNdr5ZRNbW4fvTfOqV3Xm:EMUL6555QZ3Vf3ltTBfqCNdr5ZRNbWqe

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4fccfed3868ef42c54f33dd7c002bb2c.exe
    "C:\Users\Admin\AppData\Local\Temp\4fccfed3868ef42c54f33dd7c002bb2c.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\4FCCFE~1.EXE > nul
      2⤵
      • Deletes itself
      PID:2368

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Windows\SysWOW64\RumxtwC.dll

          Filesize

          73KB

          MD5

          b916665ad5f7f82d48870e348cc8b30a

          SHA1

          0d598819f7e51ba6ad54d6ce3e026aab3a95f5a5

          SHA256

          906fc301c36ab78ad7682990ab1e05335c64405d2c143ef4eec557a2a85ce045

          SHA512

          89b817bec1e0a3aee1618698d484c29f0973b35f8bac334c67090098c18985b3d2f7a071c1c6cabcf169036df9b5ca6ecd8277c58d574685fb3431cc27572326