034bf70f09517775dec62db553f986991b5117b29f30945b7cbc32603cf45b59

Analysis

max time kernel
89s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 22:53

Target

8abdc6665b728e71a0ac1d0418eb441c.exe
Size

47KB
MD5

8abdc6665b728e71a0ac1d0418eb441c
SHA1

abe212e0fba33812ff9da2c1f1362fd2d5a666cd
SHA256

034bf70f09517775dec62db553f986991b5117b29f30945b7cbc32603cf45b59
SHA512

0bf57705cc0fc15ca290d9ee8a0ff0be89b35a8698d100066f5b7bbfebe682e35b97550c1dc5600853a289f1d9d52343d102bf9d67606e0fae1b871265c98752
SSDEEP

768:yCrWu5p9s6/KANRS8xLxzR4rw9ZRdCaAg3S3KnxdqjM4Pl8tgoz:lrWu50W9NRS8nzGs9jdCad3San6jM4ti

Score

7^/10

upx vmprotect

Loads dropped DLL 1 IoCs

pid	Process
4176	8abdc6665b728e71a0ac1d0418eb441c.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4176-0-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/4176-13-0x0000000000400000-0x0000000000429000-memory.dmp	upx

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/files/0x0006000000023201-10.dat	vmprotect

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zyjunk.cfg	8abdc6665b728e71a0ac1d0418eb441c.exe
File opened for modification	C:\Windows\SysWOW64\zyjunk2.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File opened for modification	C:\Windows\SysWOW64\zyjunk3.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File created	C:\Windows\SysWOW64\zyjunk3.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File opened for modification	C:\Windows\SysWOW64\zyjunk4.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File created	C:\Windows\SysWOW64\zyjunk4.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File created	C:\Windows\SysWOW64\mxsmnqlln.dll	8abdc6665b728e71a0ac1d0418eb441c.exe
File opened for modification	C:\Windows\SysWOW64\zyjunk1.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File created	C:\Windows\SysWOW64\zyjunk1.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File created	C:\Windows\SysWOW64\zyjunk2.dat	8abdc6665b728e71a0ac1d0418eb441c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4176	8abdc6665b728e71a0ac1d0418eb441c.exe
4176	8abdc6665b728e71a0ac1d0418eb441c.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4176	8abdc6665b728e71a0ac1d0418eb441c.exe
656	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4176	8abdc6665b728e71a0ac1d0418eb441c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4176	8abdc6665b728e71a0ac1d0418eb441c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4720	4176	8abdc6665b728e71a0ac1d0418eb441c.exe	86
PID 4176 wrote to memory of 4720	4176	8abdc6665b728e71a0ac1d0418eb441c.exe	86
PID 4176 wrote to memory of 4720	4176	8abdc6665b728e71a0ac1d0418eb441c.exe	86

C:\Users\Admin\AppData\Local\Temp\8abdc6665b728e71a0ac1d0418eb441c.exe
"C:\Users\Admin\AppData\Local\Temp\8abdc6665b728e71a0ac1d0418eb441c.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\8ABDC6~1.EXE
  2⤵
  PID:4720

C:\Windows\SysWOW64\mxsmnqlln.dll

Filesize
60KB

MD5
cc3d410c4c58a42544e4605e61e7678c

SHA1
fe8d68024efeb35fa1b1433f51cc00ee3f300f7d

SHA256
50f7c2fa85b942d7331fee82e8e9c926f093cc81aef308550e9cf840e63e0323

SHA512
0dd7bef037f599e749041d18ce06b275358e4b8682979434c268dc1073ef46d31203e63409e5073a56aeb37f32db3d07507cd99a53857106fb0c2dbcbc1c97bc

Download Submit
memory/4176-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4176-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download