6a79b18a0b6ce048bd93586272612296073c5b7c252e13f378914a9d2d7fc9a2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 20:23

Target

Loader.exe
Size

4.9MB
MD5

c01c4d326d65d94e05361c30821b2dbd
SHA1

16c0e2a2dff1e06cbdc5036d13a7444edc469193
SHA256

6a79b18a0b6ce048bd93586272612296073c5b7c252e13f378914a9d2d7fc9a2
SHA512

69ef9d5870d76e8175f5749b8ab24e9574c021fa8c2a0b0ea088bcd2ad93373efac252295395eb6f0d5896474d9f22275948dd79baded12a634e97e72f50abed
SSDEEP

98304:hpA5XNJzZJydymhLXeH1RPTC3thMtNKbLWst+QixuF:KNpydVajQthgxstR

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1628-0-0x000000013FBF0000-0x00000001405D3000-memory.dmp	vmprotect

Kills process with taskkill 1 IoCs

evasion

pid	Process
2488	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	taskkill.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2952	1628	Loader.exe	29
PID 1628 wrote to memory of 2952	1628	Loader.exe	29
PID 1628 wrote to memory of 2952	1628	Loader.exe	29
PID 2952 wrote to memory of 2116	2952	cmd.exe	30
PID 2952 wrote to memory of 2116	2952	cmd.exe	30
PID 2952 wrote to memory of 2116	2952	cmd.exe	30
PID 2116 wrote to memory of 3016	2116	net.exe	31
PID 2116 wrote to memory of 3016	2116	net.exe	31
PID 2116 wrote to memory of 3016	2116	net.exe	31
PID 1628 wrote to memory of 1972	1628	Loader.exe	32
PID 1628 wrote to memory of 1972	1628	Loader.exe	32
PID 1628 wrote to memory of 1972	1628	Loader.exe	32
PID 1972 wrote to memory of 2492	1972	cmd.exe	33
PID 1972 wrote to memory of 2492	1972	cmd.exe	33
PID 1972 wrote to memory of 2492	1972	cmd.exe	33
PID 1628 wrote to memory of 2524	1628	Loader.exe	34
PID 1628 wrote to memory of 2524	1628	Loader.exe	34
PID 1628 wrote to memory of 2524	1628	Loader.exe	34
PID 2524 wrote to memory of 2488	2524	cmd.exe	35
PID 2524 wrote to memory of 2488	2524	cmd.exe	35
PID 2524 wrote to memory of 2488	2524	cmd.exe	35
PID 1628 wrote to memory of 2620	1628	Loader.exe	37
PID 1628 wrote to memory of 2620	1628	Loader.exe	37
PID 1628 wrote to memory of 2620	1628	Loader.exe	37

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net start w32time
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c w32tm /resync /nowait
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /nowait
    3⤵
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /IM RainbowSix.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\system32\taskkill.exe
    taskkill /IM RainbowSix.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2488
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1628 -s 200
  2⤵
  PID:2620

memory/1628-0-0x000000013FBF0000-0x00000001405D3000-memory.dmp

Filesize
9.9MB

Download