Overview

overview

9

Static

static

7

hacked cli...et.exe

windows10-1703-x64

7

hacked cli...mi.exe

windows10-1703-x64

1

hacked cli...te.exe

windows10-1703-x64

1

hacked cli...v2.exe

windows10-1703-x64

7

hacked cli...sy.exe

windows10-1703-x64

6

hacked cli...ic.exe

windows10-1703-x64

1

hacked cli...ea.exe

windows10-1703-x64

1

hacked cli...id.exe

windows10-1703-x64

1

hacked cli...on.exe

windows10-1703-x64

9

hacked cli...ra.exe

windows10-1703-x64

9

hacked cli...ga.exe

windows10-1703-x64

1

hacked cli...in.exe

windows10-1703-x64

1

Analysis

  • max time kernel
    15s
  • max time network
    18s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/05/2024, 00:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    hacked client (rats) LMAO/axentav2.exe
  • Size 786KB
  • Sample240501-a7ksaadf64
  • SHA256 cedab271e30415766e897ef6b1fce37116bfc73c6bf71bfa9f3343e261fa98d7
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
vmprotect

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect

Processes

  • C:\Users\Admin\AppData\Local\Temp\hacked client (rats) LMAO\axentav2.exe
    "C:\Users\Admin\AppData\Local\Temp\hacked client (rats) LMAO\axentav2.exe"
    1⤵
      PID:4912

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/4912-0-0x000002280ED30000-0x000002280EE8E000-memory.dmp
          Download

          memory/4912-1-0x00007FFA77890000-0x00007FFA7827C000-memory.dmp
          Download

          memory/4912-2-0x00007FFA77890000-0x00007FFA7827C000-memory.dmp
          Download

          memory/4912-4-0x00007FFA77890000-0x00007FFA7827C000-memory.dmp
          Download