vsingle | a26ac74dcc443e5a22c159f0f7343062b2b5b50f4bb052da813452b3cb80338a

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 03:41

Target
Win32.exe
Size 1.2MB
Sample240701-d81rnsycpp
SHA256 eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60
MD5 01c13144ea9d9728500dc6c067bab899
SHA1 49b22529fec0c372b08e2afe67eccde13b3ab6cc
SHA512 c05cff167a896ceddb55ab7070301f815f5e4f690e046e30ca6b4381f375ce579d516a70c41b750710e73524d3d092dc9de871cb43be2efc565fd753db2fc2b6
SSDEEP 12288:eQnGcWctmPF319Ib4k24VdTl2ZYFphgIShQuSGDkDFuyjldrB:ecjZtmN7jOVdB2ZYFpqhhoGYDFuol
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vsingle loader

Detects VSingle payload 2 IoCs

resource	yara_rule
behavioral1/memory/2044-5-0x0000000000680000-0x00000000006B7000-memory.dmp	family_vsingle
behavioral1/memory/2044-6-0x0000000000680000-0x00000000006B7000-memory.dmp	family_vsingle

VSingle
VSingle is a loader written in C++ operated by the Lazarus APT group and discovered in 2022.
loader vsingle

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2044	2416	Win32.exe	28
PID 2416 wrote to memory of 2044	2416	Win32.exe	28
PID 2416 wrote to memory of 2044	2416	Win32.exe	28
PID 2416 wrote to memory of 2044	2416	Win32.exe	28
PID 2416 wrote to memory of 2044	2416	Win32.exe	28

C:\Users\Admin\AppData\Local\Temp\Win32.exe
"C:\Users\Admin\AppData\Local\Temp\Win32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\Explorer.exe
  Explorer.exe
  2⤵
  PID:2044

memory/2044-1-0x0000000000080000-0x00000000000B1000-memory.dmp

Download

memory/2044-2-0x0000000000150000-0x00000000003D1000-memory.dmp

Download

memory/2044-5-0x0000000000680000-0x00000000006B7000-memory.dmp

Download

memory/2044-6-0x0000000000680000-0x00000000006B7000-memory.dmp

Download

memory/2416-0-0x0000000000230000-0x0000000000237000-memory.dmp

Download