10ad2285aa3dd91c7f4fc13195af80d7bd7ab6908ce2ebf8c357932ea6a423a0

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 18:26

Target

c40c08285a61c1d46a2d3f5e55826988.exe
Size

85KB
MD5

c40c08285a61c1d46a2d3f5e55826988
SHA1

b2b6eadfd39eaf39ab895215010e191c5d9e5c5d
SHA256

10ad2285aa3dd91c7f4fc13195af80d7bd7ab6908ce2ebf8c357932ea6a423a0
SHA512

c59e32a2823d04f79d529675150fa8ac5a01485254adecb2db3f85502fe176ea4c0ab06c8cd865dc61ddfe28e74360eeee9827b1a7721b5f55b3a4b7ae277759
SSDEEP

1536:YrQsGzZmzK703Y7q6Vf3AQLFnToIfyTFjr5ZPN7WPHvR7J5sIF6NM1Rm:YrQdo6Vf3AQLtTBfyTFjr5ZPN7WXRJy3

Score

8^/10

vmprotect

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\beep.sys	c40c08285a61c1d46a2d3f5e55826988.exe

Deletes itself 1 IoCs

pid	Process
2352	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2200	c40c08285a61c1d46a2d3f5e55826988.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/files/0x000c0000000141c0-4.dat	vmprotect

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\RrmmthC.dll	c40c08285a61c1d46a2d3f5e55826988.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2200	c40c08285a61c1d46a2d3f5e55826988.exe
2200	c40c08285a61c1d46a2d3f5e55826988.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2200	c40c08285a61c1d46a2d3f5e55826988.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2352	2200	c40c08285a61c1d46a2d3f5e55826988.exe	28
PID 2200 wrote to memory of 2352	2200	c40c08285a61c1d46a2d3f5e55826988.exe	28
PID 2200 wrote to memory of 2352	2200	c40c08285a61c1d46a2d3f5e55826988.exe	28
PID 2200 wrote to memory of 2352	2200	c40c08285a61c1d46a2d3f5e55826988.exe	28

C:\Users\Admin\AppData\Local\Temp\c40c08285a61c1d46a2d3f5e55826988.exe
"C:\Users\Admin\AppData\Local\Temp\c40c08285a61c1d46a2d3f5e55826988.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\C40C08~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2352

\Windows\SysWOW64\RrmmthC.dll

Filesize
73KB

MD5
e9920dbb8f8dc09c2d3fc102e8d6d75b

SHA1
cd906110bc3b80e9f670dba6839a28266b99f083

SHA256
1d0547e4e415a2c0b876b464716f39549df359ed10052984186995f4a06b4203

SHA512
8b2e3e58b3018ad59bab0774cc3f3f3211e735bba9913f4946a01936dc83a99640f0b35bd8db3a66873f211544a0155bd1ab9f6a843b65503434bb51d3eb758b

Download Submit