Malware Analysis Report

2025-01-22 12:56

Sample ID 240523-bdakwsff7s
Target 17330844097.zip
SHA256 6b068ddd30f7bc3496e1626cee33626626143ba2c94b30b566df1c9dfd20f5db
Tags
vmprotect
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

6b068ddd30f7bc3496e1626cee33626626143ba2c94b30b566df1c9dfd20f5db

Threat Level: Shows suspicious behavior

The file 17330844097.zip was found to be: Shows suspicious behavior.

Malicious Activity Summary

vmprotect

VMProtect packed file

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-23 01:01

Signatures

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-23 01:01

Reported

2024-05-23 01:04

Platform

win7-20240508-en

Max time kernel

124s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ce6416059d72df767ccf87542d5637d89def1092c63e350fba9486f7ad3261a3.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\ce6416059d72df767ccf87542d5637d89def1092c63e350fba9486f7ad3261a3.exe

"C:\Users\Admin\AppData\Local\Temp\ce6416059d72df767ccf87542d5637d89def1092c63e350fba9486f7ad3261a3.exe"

Network

Country Destination Domain Proto
CN 112.192.20.45:9898 tcp
CN 112.192.20.45:9898 tcp

Files

memory/2244-0-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-3-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-6-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-9-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-13-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-15-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-4-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-8-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-11-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-12-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-16-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-14-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-17-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-18-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-10-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-7-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-5-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-2-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-1-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-20-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-23-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-26-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-29-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-32-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-37-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-42-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-45-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-50-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-53-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-61-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-63-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-19-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-21-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-40-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-64-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-62-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-60-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-59-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-58-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-57-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-56-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-55-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-54-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-52-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-51-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-49-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-48-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-47-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-46-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-44-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-43-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-41-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-39-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-38-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-36-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-35-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-34-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-33-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-840-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-839-0x00000000032A0000-0x00000000039AD000-memory.dmp

C:\Àϰ׸¨Öú\Àϰ׸¨ÖúÅäÖÃ.ini

MD5 4872847c3b38ac650b38ab626c671528
SHA1 16bb382db51c0573ed9d0a7ecbfa6846bdf5258b
SHA256 6a8526d2c6e44dd4630aeb32b0ff1894fd5f0be4359d6fd489c3813dc96616fc
SHA512 9ac69dd8c0e26ba927f92b90a9a180a68e7d50a49a451e81ddee95d5086d0f839e956131c0ca4f715618a37342bb5bcc6bfdd614ae6f9d75237bde329e6bef52

memory/2244-31-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-30-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-28-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-27-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-25-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-24-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-22-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-841-0x00000000032A0000-0x00000000039AD000-memory.dmp

memory/2244-842-0x00000000032A0000-0x00000000039AD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-23 01:01

Reported

2024-05-23 01:04

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ce6416059d72df767ccf87542d5637d89def1092c63e350fba9486f7ad3261a3.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\ce6416059d72df767ccf87542d5637d89def1092c63e350fba9486f7ad3261a3.exe

"C:\Users\Admin\AppData\Local\Temp\ce6416059d72df767ccf87542d5637d89def1092c63e350fba9486f7ad3261a3.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
CN 112.192.20.45:9898 tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 92.16.208.104.in-addr.arpa udp
CN 112.192.20.45:9898 tcp

Files

memory/2144-0-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-1-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-5-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-14-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-13-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-9-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-2-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-8-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-7-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-4-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-3-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-16-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-25-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-27-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-31-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-55-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-62-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-63-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-61-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-64-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-60-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-58-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-56-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-59-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-57-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-50-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-49-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-48-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-46-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-54-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-52-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-47-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-45-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-43-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-39-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-37-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-53-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-51-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-41-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-40-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-36-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-34-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-32-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-30-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-29-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-44-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-42-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-38-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-26-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-35-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-33-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-28-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-23-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-22-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-21-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-20-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-19-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-18-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-24-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-17-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-15-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-12-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-11-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-10-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-6-0x0000000003570000-0x0000000003C7D000-memory.dmp

C:\Àϰ׸¨Öú\Àϰ׸¨ÖúÅäÖÃ.ini

MD5 4872847c3b38ac650b38ab626c671528
SHA1 16bb382db51c0573ed9d0a7ecbfa6846bdf5258b
SHA256 6a8526d2c6e44dd4630aeb32b0ff1894fd5f0be4359d6fd489c3813dc96616fc
SHA512 9ac69dd8c0e26ba927f92b90a9a180a68e7d50a49a451e81ddee95d5086d0f839e956131c0ca4f715618a37342bb5bcc6bfdd614ae6f9d75237bde329e6bef52

memory/2144-834-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-838-0x0000000003570000-0x0000000003C7D000-memory.dmp

memory/2144-839-0x0000000003570000-0x0000000003C7D000-memory.dmp