Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2024, 06:13

General

  • Target

    4fccfed3868ef42c54f33dd7c002bb2c.exe

  • Size

    85KB

  • MD5

    4fccfed3868ef42c54f33dd7c002bb2c

  • SHA1

    9b9aca6c8c3563e8f9f7e5cd3f13459fa334eea0

  • SHA256

    02c198348bbf5ce3b7ee384c5c482a991689e219e21456048b3bc5c64a6a58b6

  • SHA512

    2208a327d77bdc39d790ec63e5fa188a32ee572cf7986de5b8ceaefe67a06a968165eb5efb010e16d02e7d0de6d6e1884b0eb8773797182bb9eed43ecfb263a5

  • SSDEEP

    1536:UHSlUL6555Qmkd74v4rYgXVf3lFnToIfqCNdr5ZRNbW4fvTfOqV3Xm:EMUL6555QZ3Vf3ltTBfqCNdr5ZRNbWqe

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4fccfed3868ef42c54f33dd7c002bb2c.exe
    "C:\Users\Admin\AppData\Local\Temp\4fccfed3868ef42c54f33dd7c002bb2c.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\4FCCFE~1.EXE > nul
      2⤵
        PID:3284

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SysWOW64\RzmgtvC.dll

            Filesize

            73KB

            MD5

            b916665ad5f7f82d48870e348cc8b30a

            SHA1

            0d598819f7e51ba6ad54d6ce3e026aab3a95f5a5

            SHA256

            906fc301c36ab78ad7682990ab1e05335c64405d2c143ef4eec557a2a85ce045

            SHA512

            89b817bec1e0a3aee1618698d484c29f0973b35f8bac334c67090098c18985b3d2f7a071c1c6cabcf169036df9b5ca6ecd8277c58d574685fb3431cc27572326