Malware Analysis Report

2025-03-15 05:53

Sample ID 240629-em282szhkd
Target dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3
SHA256 dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3
Tags
vmprotect
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3

Threat Level: Known bad

The file dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3 was found to be: Known bad.

Malicious Activity Summary

vmprotect

Detects executables packed with VMProtect.

Detects executables packed with VMProtect.

Executes dropped EXE

Loads dropped DLL

VMProtect packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-29 04:04

Signatures

Detects executables packed with VMProtect.

Description Indicator Process Target
N/A N/A N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-29 04:04

Reported

2024-06-29 04:06

Platform

win7-20240611-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe"

Signatures

Detects executables packed with VMProtect.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe

"C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /K prompt $g

Network

Files

memory/2300-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2300-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2300-36-0x0000000000426000-0x00000000006AE000-memory.dmp

memory/2300-35-0x0000000000400000-0x0000000000AE3000-memory.dmp

memory/2300-34-0x00000000002A0000-0x00000000002A1000-memory.dmp

memory/2300-32-0x00000000002A0000-0x00000000002A1000-memory.dmp

memory/2300-30-0x00000000002A0000-0x00000000002A1000-memory.dmp

memory/2300-29-0x0000000000290000-0x0000000000291000-memory.dmp

memory/2300-27-0x0000000000290000-0x0000000000291000-memory.dmp

memory/2300-24-0x0000000000280000-0x0000000000281000-memory.dmp

memory/2300-22-0x0000000000280000-0x0000000000281000-memory.dmp

memory/2300-19-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2300-17-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2300-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

memory/2300-12-0x00000000001E0000-0x00000000001E1000-memory.dmp

memory/2300-9-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/2300-7-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/2300-5-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/2300-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2300-39-0x0000000000400000-0x0000000000AE3000-memory.dmp

memory/2300-40-0x0000000005040000-0x00000000050F4000-memory.dmp

memory/2300-41-0x0000000004F90000-0x0000000005042000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\adb.exe

MD5 1eb885c863d208e330e3a961849322eb
SHA1 cf909df4d928aa9053e2817fa10232880b56ca55
SHA256 e1657ca239bcf53f60dd622a8476d51b8df3c2a3169f7b6082142942560627ed
SHA512 d5a72e2aa0170d3fa41dd968a5f5e70a568c53d5449fbd0788ad016da0b6e1f1caa2c45cfdd7fdcf0a23205150e6578d25ed215b313de8dcbdae1b3a2e67bce4

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-29 04:04

Reported

2024-06-29 04:06

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe"

Signatures

Detects executables packed with VMProtect.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\adb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\adb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\adb.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3996 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe C:\Windows\SysWOW64\cmd.exe
PID 3996 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe C:\Windows\SysWOW64\cmd.exe
PID 3996 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe C:\Windows\SysWOW64\cmd.exe
PID 2312 wrote to memory of 2016 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\adb.exe
PID 2312 wrote to memory of 2016 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\adb.exe
PID 2312 wrote to memory of 2016 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\adb.exe
PID 2312 wrote to memory of 3852 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\adb.exe
PID 2312 wrote to memory of 3852 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\adb.exe
PID 2312 wrote to memory of 3852 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\adb.exe
PID 3852 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\adb.exe C:\Users\Admin\AppData\Local\Temp\adb.exe
PID 3852 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\adb.exe C:\Users\Admin\AppData\Local\Temp\adb.exe
PID 3852 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\adb.exe C:\Users\Admin\AppData\Local\Temp\adb.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe

"C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /K prompt $g

C:\Users\Admin\AppData\Local\Temp\adb.exe

adb kill-server

C:\Users\Admin\AppData\Local\Temp\adb.exe

adb start-server

C:\Users\Admin\AppData\Local\Temp\adb.exe

adb -L tcp:5037 fork-server server --reply-fd 568

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:60145 tcp
N/A 127.0.0.1:5555 tcp
N/A 127.0.0.1:5354 tcp
N/A 127.0.0.1:5557 tcp
N/A 127.0.0.1:5559 tcp
N/A 127.0.0.1:5561 tcp
N/A 127.0.0.1:5563 tcp
N/A 127.0.0.1:5565 tcp
N/A 127.0.0.1:5354 tcp
N/A 127.0.0.1:5567 tcp
N/A 127.0.0.1:5569 tcp
N/A 127.0.0.1:5571 tcp
N/A 127.0.0.1:5573 tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
N/A 127.0.0.1:5575 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
N/A 127.0.0.1:5354 tcp
N/A 127.0.0.1:5577 tcp
N/A 127.0.0.1:5579 tcp
N/A 127.0.0.1:5581 tcp
N/A 127.0.0.1:5583 tcp
N/A 127.0.0.1:5585 tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp

Files

memory/3996-0-0x00000000026F0000-0x00000000026F1000-memory.dmp

memory/3996-1-0x0000000002700000-0x0000000002701000-memory.dmp

memory/3996-7-0x0000000002770000-0x0000000002771000-memory.dmp

memory/3996-6-0x0000000000426000-0x00000000006AE000-memory.dmp

memory/3996-5-0x0000000002760000-0x0000000002761000-memory.dmp

memory/3996-4-0x0000000002750000-0x0000000002751000-memory.dmp

memory/3996-3-0x0000000002740000-0x0000000002741000-memory.dmp

memory/3996-2-0x0000000002730000-0x0000000002731000-memory.dmp

memory/3996-8-0x0000000000400000-0x0000000000AE3000-memory.dmp

memory/3996-11-0x0000000000400000-0x0000000000AE3000-memory.dmp

memory/3996-12-0x00000000054D0000-0x0000000005584000-memory.dmp

memory/3996-14-0x0000000005B70000-0x0000000005C22000-memory.dmp

memory/3996-13-0x00000000055C0000-0x0000000005B64000-memory.dmp

memory/3996-15-0x0000000005C20000-0x0000000005CB2000-memory.dmp

memory/3996-16-0x0000000008990000-0x000000000899A000-memory.dmp

memory/3996-19-0x000000000BA30000-0x000000000BA42000-memory.dmp

memory/3996-18-0x000000000BA20000-0x000000000BA2A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\adb.exe

MD5 1eb885c863d208e330e3a961849322eb
SHA1 cf909df4d928aa9053e2817fa10232880b56ca55
SHA256 e1657ca239bcf53f60dd622a8476d51b8df3c2a3169f7b6082142942560627ed
SHA512 d5a72e2aa0170d3fa41dd968a5f5e70a568c53d5449fbd0788ad016da0b6e1f1caa2c45cfdd7fdcf0a23205150e6578d25ed215b313de8dcbdae1b3a2e67bce4

C:\Users\Admin\AppData\Local\Temp\platform-tools\fastboot.exe

MD5 07e74ee8a79ce693b3925737fee89629
SHA1 2be35f19051d2f477ef568241258c706f366bfef
SHA256 9b9281147b9a79ef7e28b9d6856771933fc08debb33861ce298b3eb9c21715b9
SHA512 2011d338c8e8be770a81252570321a0da4291fbb78877ea1d59f0609ca12cbd6d31a18accabe57348dd42597e27cc3e310f547c9bdad251028a51cd88cc26639

C:\Users\Admin\AppData\Local\Temp\platform-tools\libwinpthread-1.dll

MD5 237d93ed448e366d6d1ebc8df5a0d443
SHA1 9cd984b21dcaf1f167cf72c81a6f2196e6b578ee
SHA256 5610ca6415100dac76d2d74b3253b750c71e0c829eba47e4df9ceca30b37f254
SHA512 e9fbd346966722cbd8a646f233e38fd32f9013d225ce2ffc9a5c18be0642f80f2b221c4bba02f70fbd9fb5c84351f936f0c5e1cd438296f0a382870e4be87019

C:\Users\Admin\AppData\Local\Temp\platform-tools\AdbWinUsbApi.dll

MD5 414d7ff85d3707752cb5df159e81273b
SHA1 5c944ccae169d2b52d5442d0169fe6f2be7611a1
SHA256 25bb8b33eeb702b340defcf078eb249420c885b8f4fedfc3fc56ada66bcdbc14
SHA512 af2039ec528597adccf1268185d5e1686d2a276102197c3d028abf9167bc10d1d1b22b862f93bd880cf75ae2c2f6c5d0c862384f8be74008d468e69e21a019fb

C:\Users\Admin\AppData\Local\Temp\platform-tools\AdbWinApi.dll

MD5 819e3e651ac7f490eb1500e0df246c3e
SHA1 e4948268e2b3974d1728fe474195df011c380f45
SHA256 fd96c88a315ba271018c0b54e7d696aba16d6bac132d9afc49b60cb14e4a822c
SHA512 912da4212dc22adcb878c8b34ab7970a15878d7398643e8bbd3f6682d85fa5364f52a0e471d0c3299ad30fece47fba29a75ed5c83529fec3931343e34eba7fd0