Analysis

  • max time kernel
    134s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 12:17

General

  • Target

    e3e6c11d1fd9b262098932b5789230c3e1ac78fde5d478ce980a66b76383a051.exe

  • Size

    1.2MB

  • MD5

    8cdd1609fd3f8d7cd11abdafefe600cc

  • SHA1

    2e149827255a8bec9244e0c4d2bf9b421db25c15

  • SHA256

    e3e6c11d1fd9b262098932b5789230c3e1ac78fde5d478ce980a66b76383a051

  • SHA512

    7d7276cf510e0c5e0ed7eee366b8af64e80ecf7c65980366f58dd5c9887f5b30ae8e3ffdbe95dae332cf5a6d4396be09b31f27a90ac6fa87cc9e21788b79cb2a

  • SSDEEP

    24576:9Nm9NLzTLWhWckXLXJKybftc6JwOUv+tDsxqNOeTC+zdFlYb:9N2Lz3uZ2L5HbftcRx+ukOezzdI

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3e6c11d1fd9b262098932b5789230c3e1ac78fde5d478ce980a66b76383a051.exe
    "C:\Users\Admin\AppData\Local\Temp\e3e6c11d1fd9b262098932b5789230c3e1ac78fde5d478ce980a66b76383a051.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4792-0-0x0000000000400000-0x00000000006CB000-memory.dmp

    Filesize

    2.8MB

  • memory/4792-1-0x0000000000400000-0x00000000006CB000-memory.dmp

    Filesize

    2.8MB

  • memory/4792-2-0x0000000076080000-0x0000000076081000-memory.dmp

    Filesize

    4KB

  • memory/4792-3-0x00000000772A0000-0x00000000772A1000-memory.dmp

    Filesize

    4KB