Analysis Overview
SHA256
aec7db86a1812ea6153fca1bc43bf51fab9f85f04fb986e17bd3b1e86a10b8dd
Threat Level: Shows suspicious behavior
The file Win.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
VMProtect packed file
Legitimate hosting services abused for malware hosting/C2
Suspicious use of NtSetInformationThreadHideFromDebugger
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-22 19:51
Signatures
VMProtect packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-22 19:51
Reported
2024-05-22 19:52
Platform
win10v2004-20240426-en
Max time kernel
2s
Max time network
3s
Command Line
Signatures
VMProtect packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Win.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Win.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Win.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Win.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Win.exe
"C:\Users\Admin\AppData\Local\Temp\Win.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:62350 | tcp | |
| N/A | 127.0.0.1:62352 | tcp | |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.138.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 232.138.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.108.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| N/A | 127.0.0.1:62358 | tcp | |
| N/A | 127.0.0.1:62360 | tcp |
Files
memory/1056-0-0x000000014011B000-0x0000000140461000-memory.dmp
memory/1056-1-0x00007FFBC9A10000-0x00007FFBC9A12000-memory.dmp
memory/1056-2-0x00007FFBC9A20000-0x00007FFBC9A22000-memory.dmp
memory/1056-3-0x0000000140000000-0x00000001409DA000-memory.dmp