vsingle | 3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 10:32

Target
3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe
Size 682KB
Sample240410-mk95wafe7w
SHA256 3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7
MD5 67f4dad1a94ed8a47283c2c0c05a7594
SHA1 3aa267fbb14f73c9db55d6556fa50373716c2f1b
SHA512 29e7a6846f26fd58aeff9be712c22e526a5f18ad04c03a4b79586cb60f0f54961d4ee40415393ed89aebad2bddbaba67f00ef651c46632e77e8829fb9c4a20cf
SSDEEP 12288:3OQQtVcFaVUhHNsJbTjq8ERE//qQ6fvzWisJa6den5E/I4AANQePuqKG44O95Kqi:3OQQtVc4VUhHNsJ7q8T/b6fLcg6w5CXp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vsingle loader

Detects VSingle payload 4 IoCs

resource	yara_rule
behavioral2/memory/4244-1-0x0000000000A20000-0x0000000000A8B000-memory.dmp	family_vsingle
behavioral2/memory/4244-2-0x0000000000E40000-0x0000000000EB1000-memory.dmp	family_vsingle
behavioral2/memory/4244-5-0x0000000000A20000-0x0000000000A8B000-memory.dmp	family_vsingle
behavioral2/memory/4244-6-0x0000000000E40000-0x0000000000EB1000-memory.dmp	family_vsingle

VSingle
VSingle is a loader written in C++ operated by the Lazarus APT group and discovered in 2022.
loader vsingle

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 4244	2304	3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe	97
PID 2304 wrote to memory of 4244	2304	3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe	97
PID 2304 wrote to memory of 4244	2304	3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe	97
PID 2304 wrote to memory of 4244	2304	3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe	97

C:\Users\Admin\AppData\Local\Temp\3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe
"C:\Users\Admin\AppData\Local\Temp\3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\Explorer.exe
  Explorer.exe
  2⤵
  PID:4244

memory/2304-0-0x00000000005A0000-0x00000000005A7000-memory.dmp

Download

memory/4244-1-0x0000000000A20000-0x0000000000A8B000-memory.dmp

Download

memory/4244-2-0x0000000000E40000-0x0000000000EB1000-memory.dmp

Download

memory/4244-5-0x0000000000A20000-0x0000000000A8B000-memory.dmp

Download

memory/4244-6-0x0000000000E40000-0x0000000000EB1000-memory.dmp

Download