8b55fd0715129a16d3c746f09c73acb36b9c6cb94168430d18c565a32bc5ce77

Analysis

max time kernel
94s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b55fd0715129a16d3c746f09c73acb36b9c6cb94168430d18c565a32bc5ce77.exe
Size

10.4MB
MD5

b9416a8a0f7abe56cf0a8aa845fe6c05
SHA1

329585b2c2d03c76e481f4d0b17b1e9768a6294f
SHA256

8b55fd0715129a16d3c746f09c73acb36b9c6cb94168430d18c565a32bc5ce77
SHA512

54bd932ecc113affcaf542c883cd5db097944299b0e055720563cf52113b7bba477eb48bfcd9643655542ecd0f4ee4c634f43c51aeb0273db831efe5fa781592
SSDEEP

196608:I9iu4NrkM2kSRKETH2kEXZwk4jPm3qqDA0WdYxfdQwSLHXpgUSsbuP:I9iu4RCBECkgF0WSZdNIwnP

Score

7^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4004-20-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-28-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-26-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-24-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-16-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-14-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4004-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 17 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4004-7-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-11-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-55-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-56-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-57-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-58-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-59-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-60-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-61-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-62-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-63-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-64-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-65-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-66-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-67-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-70-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect
behavioral2/memory/4004-78-0x0000000000400000-0x0000000001851000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4004	8b55fd0715129a16d3c746f09c73acb36b9c6cb94168430d18c565a32bc5ce77.exe
4004	8b55fd0715129a16d3c746f09c73acb36b9c6cb94168430d18c565a32bc5ce77.exe
4004	8b55fd0715129a16d3c746f09c73acb36b9c6cb94168430d18c565a32bc5ce77.exe
4004	8b55fd0715129a16d3c746f09c73acb36b9c6cb94168430d18c565a32bc5ce77.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4004	8b55fd0715129a16d3c746f09c73acb36b9c6cb94168430d18c565a32bc5ce77.exe
4004	8b55fd0715129a16d3c746f09c73acb36b9c6cb94168430d18c565a32bc5ce77.exe
4004	8b55fd0715129a16d3c746f09c73acb36b9c6cb94168430d18c565a32bc5ce77.exe

C:\Users\Admin\AppData\Local\Temp\8b55fd0715129a16d3c746f09c73acb36b9c6cb94168430d18c565a32bc5ce77.exe
"C:\Users\Admin\AppData\Local\Temp\8b55fd0715129a16d3c746f09c73acb36b9c6cb94168430d18c565a32bc5ce77.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4004-0-0x0000000001870000-0x0000000001871000-memory.dmp

Filesize
4KB

Download
memory/4004-8-0x0000000000A17000-0x000000000103E000-memory.dmp

Filesize
6.2MB

Download
memory/4004-1-0x0000000001990000-0x0000000001991000-memory.dmp

Filesize
4KB

Download
memory/4004-7-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-6-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download
memory/4004-5-0x0000000001E90000-0x0000000001E91000-memory.dmp

Filesize
4KB

Download
memory/4004-4-0x0000000001E80000-0x0000000001E81000-memory.dmp

Filesize
4KB

Download
memory/4004-3-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/4004-2-0x00000000019A0000-0x00000000019A1000-memory.dmp

Filesize
4KB

Download
memory/4004-11-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-20-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-28-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-26-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-24-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-18-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-16-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-14-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4004-55-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-56-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-57-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-58-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-59-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-60-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-61-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-62-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-63-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-64-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-65-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-66-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-67-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-70-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download
memory/4004-78-0x0000000000400000-0x0000000001851000-memory.dmp

Filesize
20.3MB

Download