Analysis
-
max time kernel
139s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2024, 22:09
Behavioral task
behavioral1
Sample
VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe
Resource
win7-20231215-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe
-
Size
1.2MB
-
MD5
00234e7f7a8ad4d80445524d21d08acc
-
SHA1
03d25774b43bb1d58e3ab596fe0969b74dfd8f01
-
SHA256
c1c32cadd25039c3d2c7c2f73b702d33a1ce437b680d4dc3d2c8b8734ddc2773
-
SHA512
572bea56fcd77edf68eb892e8535f9b775ae5aea4f2047edea43a95f80a50d0760d8f000ed2a304a1e3fa1900bdb8d22750221a3f2be9b6f09d9569958086544
-
SSDEEP
24576:MORBrk2kqz3mSEfq/aPBO1hi81cRI+oTEAAciZx9/Xd/B:rrD9WSEfbg111QopLM/t
Score
9/10
Malware Config
Signatures
-
Detects executables packed with VMProtect. 3 IoCs
resource yara_rule behavioral2/memory/4528-0-0x0000000000400000-0x0000000000665000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/4528-1-0x0000000000400000-0x0000000000665000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/4528-23-0x0000000000400000-0x0000000000665000-memory.dmp INDICATOR_EXE_Packed_VMProtect -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\system32\drivers\etc\hosts VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe -
resource yara_rule behavioral2/memory/4528-0-0x0000000000400000-0x0000000000665000-memory.dmp vmprotect behavioral2/memory/4528-1-0x0000000000400000-0x0000000000665000-memory.dmp vmprotect behavioral2/memory/4528-23-0x0000000000400000-0x0000000000665000-memory.dmp vmprotect -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4528 VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe 4528 VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe 4528 VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe