1fc89a798066fe280507604da1b31f6ff5f9a329e05ee9abd2b166756f30d152

General

Target

1fc89a798066fe280507604da1b31f6ff5f9a329e05ee9abd2b166756f30d152.exe
Size

14.2MB
MD5

dd7152ef3af10ae657cc3f1f281a9c62
SHA1

11b6953186810dbdcc431ebdc73e58223f5abc6f
SHA256

1fc89a798066fe280507604da1b31f6ff5f9a329e05ee9abd2b166756f30d152
SHA512

8d3373442c559ac5ea8cfe76410887606a6fd6639451532d3658ed4bf9eaeeddd79f4f6e1f4c788545b0b7240ddbd6c03ede7f81f3ca8280f377c1aa99e92ff5
SSDEEP

393216:PZ5vHbMjt7wMEJXkjfGIg2a2mkSx6LsgdAwww:PZhHAtvaXk7phapkS4LsmAwww

Score

7^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5076-12-0x00000000035A0000-0x00000000035C6000-memory.dmp	upx
behavioral2/memory/5076-13-0x00000000036D0000-0x00000000036F6000-memory.dmp	upx

VMProtect packed file 13 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/5076-1-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect
behavioral2/memory/5076-14-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect
behavioral2/memory/5076-15-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect
behavioral2/memory/5076-16-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect
behavioral2/memory/5076-17-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect
behavioral2/memory/5076-18-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect
behavioral2/memory/5076-19-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect
behavioral2/memory/5076-20-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect
behavioral2/memory/5076-21-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect
behavioral2/memory/5076-22-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect
behavioral2/memory/5076-23-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect
behavioral2/memory/5076-24-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect
behavioral2/memory/5076-25-0x0000000000400000-0x0000000001500000-memory.dmp	vmprotect

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	1fc89a798066fe280507604da1b31f6ff5f9a329e05ee9abd2b166756f30d152.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5076	1fc89a798066fe280507604da1b31f6ff5f9a329e05ee9abd2b166756f30d152.exe
5076	1fc89a798066fe280507604da1b31f6ff5f9a329e05ee9abd2b166756f30d152.exe
5076	1fc89a798066fe280507604da1b31f6ff5f9a329e05ee9abd2b166756f30d152.exe
5076	1fc89a798066fe280507604da1b31f6ff5f9a329e05ee9abd2b166756f30d152.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5076	1fc89a798066fe280507604da1b31f6ff5f9a329e05ee9abd2b166756f30d152.exe
5076	1fc89a798066fe280507604da1b31f6ff5f9a329e05ee9abd2b166756f30d152.exe

C:\Users\Admin\AppData\Local\Temp\1fc89a798066fe280507604da1b31f6ff5f9a329e05ee9abd2b166756f30d152.exe
"C:\Users\Admin\AppData\Local\Temp\1fc89a798066fe280507604da1b31f6ff5f9a329e05ee9abd2b166756f30d152.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4332 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5076-0-0x000000000071F000-0x0000000000D71000-memory.dmp

Filesize
6.3MB

Download
memory/5076-1-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download
memory/5076-2-0x0000000001560000-0x0000000001561000-memory.dmp

Filesize
4KB

Download
memory/5076-3-0x0000000001BD0000-0x0000000001BD1000-memory.dmp

Filesize
4KB

Download
memory/5076-4-0x0000000001BE0000-0x0000000001BE1000-memory.dmp

Filesize
4KB

Download
memory/5076-5-0x0000000001C10000-0x0000000001C11000-memory.dmp

Filesize
4KB

Download
memory/5076-7-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/5076-6-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download
memory/5076-8-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/5076-12-0x00000000035A0000-0x00000000035C6000-memory.dmp

Filesize
152KB

Download
memory/5076-13-0x00000000036D0000-0x00000000036F6000-memory.dmp

Filesize
152KB

Download
memory/5076-14-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download
memory/5076-15-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download
memory/5076-16-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download
memory/5076-17-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download
memory/5076-18-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download
memory/5076-19-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download
memory/5076-20-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download
memory/5076-21-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download
memory/5076-22-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download
memory/5076-23-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download
memory/5076-24-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download
memory/5076-25-0x0000000000400000-0x0000000001500000-memory.dmp

Filesize
17.0MB

Download

Analysis

Sharing