7b7ee47232cb322c12e53f733bdef460eb8ea8b4e96faf1c2b48220e263b1e1d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7b7ee47232cb322c12e53f733bdef460eb8ea8b4e96faf1c2b48220e263b1e1d.exe
Size 6.1MB
Sample240601-wpzpdabb58
SHA256 7b7ee47232cb322c12e53f733bdef460eb8ea8b4e96faf1c2b48220e263b1e1d
MD5 50040aa4fcdf183865b768db08f93fc8
SHA1 442c47025a646e3bfecfc30f1fd229c7d083881c
SHA512 97f3b59e2fc0ce87a4c3dc4fbce49d8d1fca17337f198d5fb6886088d380bb7c2ac82d478e872a56b3ce17487725a5f8586f3868c9f6cde2b80e88a3a415c0f0
SSDEEP 98304:YyXYRyTdoWB2A3eOAJG6+ccZlWUKylsC7nRf/z7s08sQzffscv/cbTbGJZfpJLqy:K8TeWJ3ek1iUKylp7nRT8FfscXQGJBHr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2576	work.exe
2648	loglraw.exe

Loads dropped DLL 5 IoCs

pid	Process
2920	cmd.exe
2576	work.exe
2576	work.exe
2576	work.exe
2576	work.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000800000001565d-24.dat	vmprotect
behavioral1/memory/2648-44-0x00000000001F0000-0x0000000000AF4000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2648	loglraw.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2920	1048	7b7ee47232cb322c12e53f733bdef460eb8ea8b4e96faf1c2b48220e263b1e1d.exe	28
PID 1048 wrote to memory of 2920	1048	7b7ee47232cb322c12e53f733bdef460eb8ea8b4e96faf1c2b48220e263b1e1d.exe	28
PID 1048 wrote to memory of 2920	1048	7b7ee47232cb322c12e53f733bdef460eb8ea8b4e96faf1c2b48220e263b1e1d.exe	28
PID 1048 wrote to memory of 2920	1048	7b7ee47232cb322c12e53f733bdef460eb8ea8b4e96faf1c2b48220e263b1e1d.exe	28
PID 2920 wrote to memory of 2576	2920	cmd.exe	30
PID 2920 wrote to memory of 2576	2920	cmd.exe	30
PID 2920 wrote to memory of 2576	2920	cmd.exe	30
PID 2920 wrote to memory of 2576	2920	cmd.exe	30
PID 2576 wrote to memory of 2648	2576	work.exe	31
PID 2576 wrote to memory of 2648	2576	work.exe	31
PID 2576 wrote to memory of 2648	2576	work.exe	31
PID 2576 wrote to memory of 2648	2576	work.exe	31

C:\Users\Admin\AppData\Local\Temp\7b7ee47232cb322c12e53f733bdef460eb8ea8b4e96faf1c2b48220e263b1e1d.exe
"C:\Users\Admin\AppData\Local\Temp\7b7ee47232cb322c12e53f733bdef460eb8ea8b4e96faf1c2b48220e263b1e1d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
    work.exe -priverdD
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\loglraw.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\loglraw.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
Size 35B
SHA256 065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2
MD5 ff59d999beb970447667695ce3273f75
SHA1 316fa09f467ba90ac34a054daf2e92e6e2854ff8
SHA512 d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d
MD5 SHA1 SHA512

Submit Download

work.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
Size 5.8MB
SHA256 230d1bfb55ee137e9235af2a22e124eaeb5df63b2b46369ec91b391e74113c00
MD5 354723d7db32101f5abcea2a9fea41db
SHA1 004efef24d96df7842eac576928372b73369b34d
SHA512 171a32d046bf5d5394b4ab4e4c2915e5bca7869ab979c5cecfc209fe6822a6bce7945762948ef64c3f2d03c9040c4f23ac19439faada57a61068581c1d83e1e2
SSDEEP 98304:cXYRyTdoWB2A3eOAJG6+ccZlWUKylsC7nRf/z7s08sQzffscv/cbTbGJZfpJLq1:X8TeWJ3ek1iUKylp7nRT8FfscXQGJBHo
MD5 SHA1 SHA512 SSDEEP

Submit Download

loglraw.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX1\loglraw.exe
Size 5.5MB
SHA256 31dded008e6a8f5d8489e0fbe8abce5de8e0b25e7733c4c6818aa7e687cf2f1c
MD5 972041f782ed8a26d04becf8b6717e70
SHA1 235cd9522503b69f34195de93f8f8d9e5d75414e
SHA512 bb0288de9dff5f26f599f23c0d587526de43ae58e337ffd07a29614e86cb8f62dfb03c7fcae48c7398b2c1113b0a84202d43f45312af56e1d5157a74186898bc
SSDEEP 98304:04weRQWgsXZAPBZFxZh1rn/0rpLscdvFzLguIyl/dHAh3nSN1S/ym7rlVF8:04RQWgsWJZLZh1r/01LscdvFllVgxSNI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2648-42-0x0000000000070000-0x0000000000071000-memory.dmp

Download

memory/2648-44-0x00000000001F0000-0x0000000000AF4000-memory.dmp

Download

memory/2648-40-0x0000000000070000-0x0000000000071000-memory.dmp

Download

memory/2648-38-0x0000000000070000-0x0000000000071000-memory.dmp

Download