e832d8ce5921e9569543d03f80d94e354d7963d0bbfaa966e9ed86a9cc24f814

Analysis

max time kernel
132s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e832d8ce5921e9569543d03f80d94e354d7963d0bbfaa966e9ed86a9cc24f814.exe
Size

12.0MB
MD5

60a0ee989e8186a4bfbc55879d0475ce
SHA1

f6563a318aa3225c0ddffa2f5681f1de6ded9e93
SHA256

e832d8ce5921e9569543d03f80d94e354d7963d0bbfaa966e9ed86a9cc24f814
SHA512

039e5bfd2c60336ce01be2103113d4c69a756db8c0d782fc758ad87aea08c967cbc4b77ead84bee0b69ee74caa2e5c722bf5f16026bfc61912c3ee7396924234
SSDEEP

196608:IsfF58LaJHlB7g4lmjsb5o8j9Bdj4QjkBMwrhKjrZ/o4G1I2MoUF2kj:I05Jt7g4lmjsNo8p4fVK9GT0Jj

Score

7^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2176-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-53-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-35-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-33-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-31-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2176-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 13 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/2176-7-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect
behavioral2/memory/2176-54-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect
behavioral2/memory/2176-55-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect
behavioral2/memory/2176-56-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect
behavioral2/memory/2176-57-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect
behavioral2/memory/2176-58-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect
behavioral2/memory/2176-59-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect
behavioral2/memory/2176-60-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect
behavioral2/memory/2176-61-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect
behavioral2/memory/2176-62-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect
behavioral2/memory/2176-63-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect
behavioral2/memory/2176-64-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect
behavioral2/memory/2176-65-0x0000000000400000-0x0000000001E92000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2176	e832d8ce5921e9569543d03f80d94e354d7963d0bbfaa966e9ed86a9cc24f814.exe
2176	e832d8ce5921e9569543d03f80d94e354d7963d0bbfaa966e9ed86a9cc24f814.exe
2176	e832d8ce5921e9569543d03f80d94e354d7963d0bbfaa966e9ed86a9cc24f814.exe
2176	e832d8ce5921e9569543d03f80d94e354d7963d0bbfaa966e9ed86a9cc24f814.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2176	e832d8ce5921e9569543d03f80d94e354d7963d0bbfaa966e9ed86a9cc24f814.exe
2176	e832d8ce5921e9569543d03f80d94e354d7963d0bbfaa966e9ed86a9cc24f814.exe
2176	e832d8ce5921e9569543d03f80d94e354d7963d0bbfaa966e9ed86a9cc24f814.exe

C:\Users\Admin\AppData\Local\Temp\e832d8ce5921e9569543d03f80d94e354d7963d0bbfaa966e9ed86a9cc24f814.exe
"C:\Users\Admin\AppData\Local\Temp\e832d8ce5921e9569543d03f80d94e354d7963d0bbfaa966e9ed86a9cc24f814.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-2-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/2176-6-0x0000000003D90000-0x0000000003D91000-memory.dmp

Filesize
4KB

Download
memory/2176-9-0x0000000000D2B000-0x0000000001368000-memory.dmp

Filesize
6.2MB

Download
memory/2176-5-0x0000000003D80000-0x0000000003D81000-memory.dmp

Filesize
4KB

Download
memory/2176-7-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download
memory/2176-4-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2176-3-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/2176-0-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/2176-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-53-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-51-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-54-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download
memory/2176-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-35-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-33-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-31-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-55-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download
memory/2176-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2176-56-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download
memory/2176-57-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download
memory/2176-58-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download
memory/2176-59-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download
memory/2176-60-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download
memory/2176-61-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download
memory/2176-62-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download
memory/2176-63-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download
memory/2176-64-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download
memory/2176-65-0x0000000000400000-0x0000000001E92000-memory.dmp

Filesize
26.6MB

Download