Malware Analysis Report

2025-08-11 06:11

Sample ID 240610-1mxt8a1hma
Target VirusShare_684fda3866eb6967ede8bd784ad90680
SHA256 83cd26fc0f2642307179d45e3cfb8610fe2451d4d3d5abdca2521d22e35db6ca
Tags
persistence upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

83cd26fc0f2642307179d45e3cfb8610fe2451d4d3d5abdca2521d22e35db6ca

Threat Level: Shows suspicious behavior

The file VirusShare_684fda3866eb6967ede8bd784ad90680 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence upx

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-10 21:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 21:46

Reported

2024-06-10 21:49

Platform

win7-20240508-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\9iDEKdVR\WindowsSecurityUpdate.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\SD2014 = "C:\\Users\\Admin\\AppData\\Roaming\\9iDEKdVR\\9iDEKdVR.exe" C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe

"C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe"

C:\Users\Admin\AppData\Roaming\9iDEKdVR\WindowsSecurityUpdate.exe

"C:\Users\Admin\AppData\Roaming\9iDEKdVR\WindowsSecurityUpdate.exe" -services

Network

Country Destination Domain Proto
TW 175.41.29.179:80 tcp
TW 175.41.29.179:80 tcp

Files

memory/1580-0-0x0000000000370000-0x0000000000374000-memory.dmp

memory/1580-1-0x0000000000400000-0x0000000000515000-memory.dmp

\Users\Admin\AppData\Roaming\9iDEKdVR\WindowsSecurityUpdate.exe

MD5 684fda3866eb6967ede8bd784ad90680
SHA1 60531a62f6af7589949ac5d06ceb2a32665bf42f
SHA256 83cd26fc0f2642307179d45e3cfb8610fe2451d4d3d5abdca2521d22e35db6ca
SHA512 e2eb71a011d9a2cb465e21f9fabbcfb166c64b8618bad6694d82f42f8622024b71d467fcc25ef4f59bbc429a7330ac461c617ae1084e26eb644bf27b65af05bf

memory/2680-17-0x0000000000400000-0x0000000000515000-memory.dmp

memory/2680-22-0x0000000000400000-0x0000000000515000-memory.dmp

memory/2680-24-0x0000000000400000-0x0000000000515000-memory.dmp

memory/1580-26-0x0000000000400000-0x0000000000515000-memory.dmp

memory/1580-30-0x0000000000400000-0x0000000000515000-memory.dmp

C:\Users\Admin\Desktop\System Doctor 2014 support.url

MD5 d201abad2d2dca1ccd401e4419421267
SHA1 773e9bc9f8adc19db7bf4cb45e66765a2c0da0d8
SHA256 85a638446470746e8b6329fa052c8e3a9e3e53ba6e800228498f524778d5fb5a
SHA512 75c585d579b4cef4d0f124f2d6eb01482747a591f5ea708f53d717fc810c9c830519dc0742d26f523f4214ca791e1b5c200b45a1654f6bd044b0b4e1f9a11856

memory/1580-62-0x0000000000400000-0x0000000000515000-memory.dmp

memory/1580-63-0x0000000000400000-0x0000000000515000-memory.dmp

memory/1580-64-0x0000000000400000-0x0000000000515000-memory.dmp

memory/1580-65-0x0000000000400000-0x0000000000515000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 21:46

Reported

2024-06-10 21:49

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

59s

Command Line

"C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe

"C:\Users\Admin\AppData\Local\Temp\VirusShare_684fda3866eb6967ede8bd784ad90680.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1624 -ip 1624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 768

Network

Files

memory/1624-0-0x0000000000800000-0x0000000000804000-memory.dmp

memory/1624-1-0x0000000000400000-0x0000000000515000-memory.dmp