Overview

overview

10

Static

static

10

191a3ad3ca...e5.exe

windows7-x64

9

191a3ad3ca...e5.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    191a3ad3ca5267de21e0e7a603bfa7776f6b238ff84972ebacac1a122fe19ae5

  • Size

    232KB

  • Sample

    240424-qt931sag7y

  • MD5

    9829ecdc9acac3b1f3a3cbe4ffa4ff05

  • SHA1

    c71a31af3c3f1f5e18d4847296d52b2386af04c8

  • SHA256

    191a3ad3ca5267de21e0e7a603bfa7776f6b238ff84972ebacac1a122fe19ae5

  • SHA512

    4c67b8f1c338e7b7c58e0052d273507eb196a58a0d659443a718d0aba54c34e5f504291502b01f14a58b3de0bcb7669ac3c55e27ffe6e3a121e499ed08982013

  • SSDEEP

    3072:JIXc06svz8knymGzZ2rjZqfWZ5e+hAZhkpPLgA2BqlvDHnevwyR86G4cZa3v:JIslsL1Ja2zfAZ2P8HB2Uwyyk80

Score
10/10
vmprotect

Malware Config

Targets

    • Target

      191a3ad3ca5267de21e0e7a603bfa7776f6b238ff84972ebacac1a122fe19ae5

    • Size

      232KB

    • MD5

      9829ecdc9acac3b1f3a3cbe4ffa4ff05

    • SHA1

      c71a31af3c3f1f5e18d4847296d52b2386af04c8

    • SHA256

      191a3ad3ca5267de21e0e7a603bfa7776f6b238ff84972ebacac1a122fe19ae5

    • SHA512

      4c67b8f1c338e7b7c58e0052d273507eb196a58a0d659443a718d0aba54c34e5f504291502b01f14a58b3de0bcb7669ac3c55e27ffe6e3a121e499ed08982013

    • SSDEEP

      3072:JIXc06svz8knymGzZ2rjZqfWZ5e+hAZhkpPLgA2BqlvDHnevwyR86G4cZa3v:JIslsL1Ja2zfAZ2P8HB2Uwyyk80

    Score
    9/10
    vmprotect

    • Detects executables packed with VMProtect.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks