c6f5607edc349b4c6f42ef6f0c5bbd77b56ad538a747a8d7a508f11d2277948b

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VapeClient.exe
Size

8.1MB
MD5

02791ad2d947ebdb938f93d2d5ed030d
SHA1

42ac01af1dc957d9dc94f241507812f9fe3a01b8
SHA256

c6f5607edc349b4c6f42ef6f0c5bbd77b56ad538a747a8d7a508f11d2277948b
SHA512

3fb20d156052cf13cd946345eeb914d548c0db9f136065a9a13df618e60a29436ea8faa8a1f8041b1ed0beae237eb92cc1826bb850ba61d3c8d602af8e8532ac
SSDEEP

49152:AHYNTlMLejxW3XZxG7jD0fYHpjls2su6DIvZ83m+ZUh2iB6XQkddqonuMVf68HF+:AwCyjx4XZ1fcTyrIxOS

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1200 set thread context of 2676	1200	VapeClient.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	2676	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	VapeClient.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 1200 wrote to memory of 2676	1200	VapeClient.exe	28
PID 2676 wrote to memory of 2712	2676	RegAsm.exe	29
PID 2676 wrote to memory of 2712	2676	RegAsm.exe	29
PID 2676 wrote to memory of 2712	2676	RegAsm.exe	29
PID 2676 wrote to memory of 2712	2676	RegAsm.exe	29

C:\Users\Admin\AppData\Local\Temp\VapeClient.exe
"C:\Users\Admin\AppData\Local\Temp\VapeClient.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 256
    3⤵
    - Program crash
    PID:2712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-19-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1200-1-0x00000000010A0000-0x00000000018C6000-memory.dmp

Filesize
8.1MB

Download
memory/1200-2-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1200-3-0x00000000003B0000-0x00000000003C0000-memory.dmp

Filesize
64KB

Download
memory/1200-4-0x0000000000500000-0x0000000000508000-memory.dmp

Filesize
32KB

Download
memory/1200-0-0x00000000743EE000-0x00000000743EF000-memory.dmp

Filesize
4KB

Download
memory/2676-17-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2676-20-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2676-9-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2676-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2676-6-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2676-13-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2676-11-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2676-8-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2676-5-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2676-7-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2676-22-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads