Malware Analysis Report

2025-01-22 12:56

Sample ID 240522-2dgbjsbc5t
Target fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b
SHA256 fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b
Tags
vmprotect
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b

Threat Level: Shows suspicious behavior

The file fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b was found to be: Shows suspicious behavior.

Malicious Activity Summary

vmprotect

Loads dropped DLL

VMProtect packed file

Executes dropped EXE

Program crash

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-22 22:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-22 22:27

Reported

2024-05-22 22:30

Platform

win7-20240221-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\42.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\Documents\42.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\42.exe N/A
N/A N/A C:\Users\Admin\Documents\42.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b.exe

"C:\Users\Admin\AppData\Local\Temp\fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b.exe"

C:\Users\Admin\Documents\42.exe

C:\Users\Admin\Documents\\42.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 280

Network

N/A

Files

\Users\Admin\Documents\42.exe

MD5 4e0202ccfa1552e6ee8acb23792a09ae
SHA1 3da801bd451c70140f014dc310b3aac5affd1b03
SHA256 11287aec659f6016e9cbb360165edcec99e3c7321a26ab8b038d633ae624c95a
SHA512 bdb1bfc58887ba2549fb33c319d72730bf071f926d0e58ede211b34cd6b9e9babf350b939fc3b514abc48fda2f216571a21a646ba4b1da54fd6af6124d93067a

memory/2128-14-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2128-12-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2128-17-0x0000000000250000-0x0000000000251000-memory.dmp

memory/2128-16-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2128-19-0x0000000000250000-0x0000000000251000-memory.dmp

memory/2128-46-0x00000000002A0000-0x00000000002A1000-memory.dmp

memory/2128-44-0x00000000002A0000-0x00000000002A1000-memory.dmp

memory/2128-42-0x00000000002A0000-0x00000000002A1000-memory.dmp

memory/2128-41-0x0000000000290000-0x0000000000291000-memory.dmp

memory/2128-39-0x0000000000290000-0x0000000000291000-memory.dmp

memory/2128-36-0x0000000000280000-0x0000000000281000-memory.dmp

memory/2128-34-0x0000000000280000-0x0000000000281000-memory.dmp

memory/2128-31-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2128-29-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2128-26-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2128-24-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2128-21-0x0000000000250000-0x0000000000251000-memory.dmp

memory/2128-47-0x0000000000400000-0x0000000001974000-memory.dmp

memory/2128-49-0x00000000005B1000-0x0000000000E38000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-22 22:27

Reported

2024-05-22 22:30

Platform

win10v2004-20240508-en

Max time kernel

130s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\42.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\Documents\42.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\42.exe N/A
N/A N/A C:\Users\Admin\Documents\42.exe N/A
N/A N/A C:\Users\Admin\Documents\42.exe N/A
N/A N/A C:\Users\Admin\Documents\42.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b.exe

"C:\Users\Admin\AppData\Local\Temp\fcb143844f85ee32c951b6def2200e2e3cce73f95bbaf4697c7ad80243144e1b.exe"

C:\Users\Admin\Documents\42.exe

C:\Users\Admin\Documents\\42.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2340 -ip 2340

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 672

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
NL 23.62.61.113:443 www.bing.com tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 113.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

C:\Users\Admin\Documents\42.exe

MD5 4e0202ccfa1552e6ee8acb23792a09ae
SHA1 3da801bd451c70140f014dc310b3aac5affd1b03
SHA256 11287aec659f6016e9cbb360165edcec99e3c7321a26ab8b038d633ae624c95a
SHA512 bdb1bfc58887ba2549fb33c319d72730bf071f926d0e58ede211b34cd6b9e9babf350b939fc3b514abc48fda2f216571a21a646ba4b1da54fd6af6124d93067a

memory/2340-8-0x0000000001F50000-0x0000000001F51000-memory.dmp

memory/2340-7-0x00000000019D0000-0x00000000019D1000-memory.dmp

memory/2340-12-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

memory/2340-11-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

memory/2340-10-0x0000000001F90000-0x0000000001F91000-memory.dmp

memory/2340-9-0x0000000001F80000-0x0000000001F81000-memory.dmp

memory/2340-15-0x00000000005B1000-0x0000000000E38000-memory.dmp

memory/2340-13-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

memory/2340-14-0x0000000000400000-0x0000000001974000-memory.dmp

memory/2340-18-0x0000000000400000-0x0000000001974000-memory.dmp

memory/2340-19-0x0000000000400000-0x0000000001974000-memory.dmp

memory/2340-20-0x00000000005B1000-0x0000000000E38000-memory.dmp