Overview
overview
10Static
static
10Protect.rar
windows7-x64
3Protect.rar
windows10-2004-x64
3Protect/Co...on.dll
windows7-x64
1Protect/Co...on.dll
windows10-2004-x64
1Protect/Core.dll
windows7-x64
1Protect/Core.dll
windows10-2004-x64
1Protect/Co...config
windows7-x64
3Protect/Co...config
windows10-2004-x64
3Protect/Custom.txt
windows7-x64
1Protect/Custom.txt
windows10-2004-x64
1Protect/Guna.UI2.dll
windows7-x64
1Protect/Guna.UI2.dll
windows10-2004-x64
1Protect/Hardening.dll
windows7-x64
1Protect/Hardening.dll
windows10-2004-x64
1Protect/Ha...config
windows7-x64
3Protect/Ha...config
windows10-2004-x64
3Protect/Runtime.dll
windows7-x64
1Protect/Runtime.dll
windows10-2004-x64
1Protect/SE...config
windows7-x64
3Protect/SE...config
windows10-2004-x64
3Protect/Saved.txt
windows7-x64
1Protect/Saved.txt
windows10-2004-x64
1Protect/VMUtils.dll
windows7-x64
1Protect/VMUtils.dll
windows10-2004-x64
1Protect/Webhook.txt
windows7-x64
1Protect/Webhook.txt
windows10-2004-x64
1Protect/bi...IT.exe
windows7-x64
10Protect/bi...IT.exe
windows10-2004-x64
10Protect/dnlib.dll
windows7-x64
1Protect/dnlib.dll
windows10-2004-x64
1Protect/dnlib.xml
windows7-x64
1Protect/dnlib.xml
windows10-2004-x64
1Analysis
-
max time kernel
294s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 15:33
Behavioral task
behavioral1
Sample
Protect.rar
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Protect.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Protect/CodeEncryption.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
Protect/CodeEncryption.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Protect/Core.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Protect/Core.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Protect/Core.dll.config
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
Protect/Core.dll.config
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Protect/Custom.txt
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
Protect/Custom.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
Protect/Guna.UI2.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
Protect/Guna.UI2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Protect/Hardening.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
Protect/Hardening.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Protect/Hardening.dll.config
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
Protect/Hardening.dll.config
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Protect/Runtime.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Protect/Runtime.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
Protect/SECURE BYTE GUI.exe.config
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
Protect/SECURE BYTE GUI.exe.config
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
Protect/Saved.txt
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
Protect/Saved.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Protect/VMUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Protect/VMUtils.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
Protect/Webhook.txt
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
Protect/Webhook.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Protect/bimno1-JIT.exe
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
Protect/bimno1-JIT.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
Protect/dnlib.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Protect/dnlib.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
Protect/dnlib.xml
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Protect/dnlib.xml
Resource
win10v2004-20240226-en
General
-
Target
Protect.rar
-
Size
2.9MB
-
MD5
3b2cbe7b708cc29f9bd6131bb5f713f7
-
SHA1
748d27ad13d0216f924735317be579ff7adcaa20
-
SHA256
1d8c80f52a16666330f204788cc9eb42d0439a4ff81ae39ffdf3ad3103751366
-
SHA512
3565f70813adbfb06226a26ecd66fb068c03b7a17565bafa5ef507ca49a839d6cff053a682ce27eab25b9a817e5b794bd25dac2b31172b7e8708679eec1f2303
-
SSDEEP
49152:I5Bdkfblp10z/MDhhEEJrneobhInah3edweoDfkOJxm/zDrTUwjzNpOBOzm0:I5BslPKMDhhrVnNS0ew5Ds3zDUwPjOM3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2924 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 2924 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
vlc.exepid process 2924 vlc.exe 2924 vlc.exe 2924 vlc.exe 2924 vlc.exe 2924 vlc.exe 2924 vlc.exe 2924 vlc.exe 2924 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
vlc.exepid process 2924 vlc.exe 2924 vlc.exe 2924 vlc.exe 2924 vlc.exe 2924 vlc.exe 2924 vlc.exe 2924 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2924 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exerundll32.exerundll32.exedescription pid process target process PID 2052 wrote to memory of 2180 2052 cmd.exe rundll32.exe PID 2052 wrote to memory of 2180 2052 cmd.exe rundll32.exe PID 2052 wrote to memory of 2180 2052 cmd.exe rundll32.exe PID 2180 wrote to memory of 3020 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 3020 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 3020 2180 rundll32.exe rundll32.exe PID 3020 wrote to memory of 2924 3020 rundll32.exe vlc.exe PID 3020 wrote to memory of 2924 3020 rundll32.exe vlc.exe PID 3020 wrote to memory of 2924 3020 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Protect.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Protect.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Protect.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Protect.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2924-30-0x000007FEFAD70000-0x000007FEFADA4000-memory.dmpFilesize
208KB
-
memory/2924-29-0x000000013F030000-0x000000013F128000-memory.dmpFilesize
992KB
-
memory/2924-32-0x000007FEFAD50000-0x000007FEFAD68000-memory.dmpFilesize
96KB
-
memory/2924-33-0x000007FEFAD30000-0x000007FEFAD47000-memory.dmpFilesize
92KB
-
memory/2924-34-0x000007FEFAD10000-0x000007FEFAD21000-memory.dmpFilesize
68KB
-
memory/2924-35-0x000007FEFACF0000-0x000007FEFAD07000-memory.dmpFilesize
92KB
-
memory/2924-36-0x000007FEF78E0000-0x000007FEF78F1000-memory.dmpFilesize
68KB
-
memory/2924-37-0x000007FEF78C0000-0x000007FEF78DD000-memory.dmpFilesize
116KB
-
memory/2924-38-0x000007FEF7640000-0x000007FEF7651000-memory.dmpFilesize
68KB
-
memory/2924-31-0x000007FEF5EF0000-0x000007FEF61A6000-memory.dmpFilesize
2.7MB
-
memory/2924-45-0x000007FEF6C30000-0x000007FEF6C41000-memory.dmpFilesize
68KB
-
memory/2924-47-0x000007FEF6A10000-0x000007FEF6A2B000-memory.dmpFilesize
108KB
-
memory/2924-48-0x000007FEF6610000-0x000007FEF6621000-memory.dmpFilesize
68KB
-
memory/2924-40-0x000007FEF5A60000-0x000007FEF5C6B000-memory.dmpFilesize
2.0MB
-
memory/2924-41-0x000007FEF6A80000-0x000007FEF6AC1000-memory.dmpFilesize
260KB
-
memory/2924-44-0x000007FEF7060000-0x000007FEF7071000-memory.dmpFilesize
68KB
-
memory/2924-46-0x000007FEF6A30000-0x000007FEF6A41000-memory.dmpFilesize
68KB
-
memory/2924-43-0x000007FEF7620000-0x000007FEF7638000-memory.dmpFilesize
96KB
-
memory/2924-50-0x000007FEF65C0000-0x000007FEF65F0000-memory.dmpFilesize
192KB
-
memory/2924-59-0x000007FEF58B0000-0x000007FEF58C1000-memory.dmpFilesize
68KB
-
memory/2924-60-0x000007FEF5890000-0x000007FEF58A2000-memory.dmpFilesize
72KB
-
memory/2924-58-0x000007FEF58D0000-0x000007FEF58F3000-memory.dmpFilesize
140KB
-
memory/2924-57-0x000007FEF5900000-0x000007FEF5918000-memory.dmpFilesize
96KB
-
memory/2924-56-0x000007FEF5920000-0x000007FEF5944000-memory.dmpFilesize
144KB
-
memory/2924-55-0x000007FEF5950000-0x000007FEF5978000-memory.dmpFilesize
160KB
-
memory/2924-54-0x000007FEF5980000-0x000007FEF59D7000-memory.dmpFilesize
348KB
-
memory/2924-53-0x000007FEF6530000-0x000007FEF6541000-memory.dmpFilesize
68KB
-
memory/2924-52-0x000007FEF59E0000-0x000007FEF5A5C000-memory.dmpFilesize
496KB
-
memory/2924-51-0x000007FEF6550000-0x000007FEF65B7000-memory.dmpFilesize
412KB
-
memory/2924-49-0x000007FEF65F0000-0x000007FEF6608000-memory.dmpFilesize
96KB
-
memory/2924-42-0x000007FEF6A50000-0x000007FEF6A71000-memory.dmpFilesize
132KB
-
memory/2924-39-0x000007FEF42D0000-0x000007FEF5380000-memory.dmpFilesize
16.7MB