8ff8af7b31fe7ed58b2afc1b556c635c2ccdf20bce7ca371897dea490a8b5027

Submit
Reports

Overview

overview

Static

static

001a09a29d...ad.exe

windows7-x64

001e9cb57f...ea.exe

windows7-x64

00ace607a4...64.exe

windows7-x64

0a20f03af5...77.exe

windows7-x64

0a6c62c139...b8.exe

windows7-x64

0a747a5f77...c2.exe

windows7-x64

0b02c55fbb...c0.exe

windows7-x64

0b716abe15...7f.exe

windows7-x64

0b997e8b0d...46.exe

windows7-x64

0bb2957b2b...1e.exe

windows7-x64

0bd9556e36...74.exe

windows7-x64

0c0c9a19db...c1.exe

windows7-x64

0c7da4e446...86.exe

windows7-x64

0cad47e2df...6a.exe

windows7-x64

0cb554caaf...b2.exe

windows7-x64

0cbb472b55...43.exe

windows7-x64

0d25bbbeb6...09.exe

windows7-x64

0d9ea4a12d...0e.exe

windows7-x64

0dbfd3479c...8d.exe

windows7-x64

0ddcce08b7...35.exe

windows7-x64

0df9bd640a...72.exe

windows7-x64

0e52434683...e4.exe

windows7-x64

0e767dfa6d...e4.exe

windows7-x64

0e82ed8dab...a4.exe

windows7-x64

0e98661ea6...29.exe

windows7-x64

0e9f24d9b1...d5.exe

windows7-x64

0ec44257a6...68.exe

windows7-x64

0f18f6547a...57.exe

windows7-x64

0f3d700c95...90.exe

windows7-x64

0f54e0f3c3...36.exe

windows7-x64

0f5ace8adb...72.exe

windows7-x64

0fc4a985ae...f8.exe

windows7-x64

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 09:29

Sharing

Copy URL

Twitter E-mail

Static task

static1

12 signatures

Behavioral task

behavioral1

Sample

001a09a29deab5195eda46bad91e51b234655325b641e211ed8234e934956ead.exe

Resource

win7-20240708-en

persistence ransomware

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

001e9cb57f9e922d7b0d92ec43b8b5e376c5ab6e4ea827b84c76e13c994fbbea.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe

Resource

win7-20240708-en

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral4

Sample

0a20f03af50d14404b349279b3dc20886b1bf91419ede3f1b0c7fbdda579ae77.exe

Resource

win7-20240704-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

0a6c62c139aa9baf898add2a10fada3d49f78b3089507b84e613868242e169b8.exe

Resource

win7-20240704-en

persistence

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral6

Sample

0a747a5f771168c0c32e944da6d6d996f24284e4fb44eaea562b21266a9e3ac2.exe

Resource

win7-20240705-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

0b02c55fbb40d7757b5808efe3fd1343f943bcefb92e0009689f4995e3eb26c0.exe

Resource

win7-20240705-en

themida

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

0b716abe15b17a114c2f12fab954c861f82165bb0868f863cfb8dc634f76be7f.exe

Resource

win7-20240708-en

chaos ransomware spyware stealer

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral9

Sample

0b997e8b0d0ff6cc4e6f1919c6c0f3080eaa0d08c8fccdf50f7648bf05cca446.exe

Resource

win7-20240708-en

phobos defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral10

Sample

0bb2957b2b8ed0a1c458da6edeaf5a48b2c1ecdd7d7ed33d00749ef1f5653b1e.exe

Resource

win7-20240708-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral11

Sample

0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

0c0c9a19db1f89d94ddcd8af54fa631798e3ccc82743faae6d9818759f2dbcc1.exe

Resource

win7-20240705-en

neshta phobos defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer

windows7-x64

27 signatures

150 seconds

Behavioral task

behavioral13

Sample

0c7da4e446a97f08bbf6c0abe987810047163150d70f0a282c2f7cea674d7286.exe

Resource

win7-20240705-en

persistence ransomware

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral14

Sample

0cad47e2dfd2538735f7affa42f9aad5d7bf453d88dbeb901e9b06fcae871e6a.exe

Resource

win7-20240704-en

persistence ransomware

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral15

Sample

0cb554caafe5c2d40c1f882ca04710752194ebf300e0050bd7b7511312ae61b2.exe

Resource

win7-20240704-en

persistence ransomware

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral16

Sample

0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe

Resource

win7-20240708-en

dharma defense_evasion execution impact persistence ransomware spyware stealer

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral17

Sample

0d25bbbeb68847cab4f3805bb8028ca901aa569abb038660c5febfe2ba24ec09.exe

Resource

win7-20240708-en

ryuk defense_evasion discovery evasion execution impact persistence ransomware

windows7-x64

30 signatures

150 seconds

Behavioral task

behavioral18

Sample

0d9ea4a12d29d79b00bd3d0788f531642832b799bdc3baaebd0ee213cee4720e.exe

Resource

win7-20240705-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

0dbfd3479cfaf0856eb8a75f0ad4fccb5fd6bd17164bcfa6a5a386ed7378958d.exe

Resource

win7-20240708-en

persistence ransomware

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral20

Sample

0ddcce08b727ccbbae208459032f010956794a84b7f35e225b5bae927b0f6835.exe

Resource

win7-20240705-en

persistence

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral21

Sample

0df9bd640ad5bb636095c524e54f9152bb84092889e720dcaa549e65dc3c1472.exe

Resource

win7-20240708-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

0e524346835f7c208667a18699df3faf34fcf8a3cceab8a7418d3f88e87211e4.exe

Resource

win7-20240705-en

chaos neshta defense_evasion evasion execution impact persistence ransomware spyware stealer

windows7-x64

24 signatures

150 seconds

Behavioral task

behavioral23

Sample

0e767dfa6d7887e832225433ed8866195df94607ccb474868b9abbbf20843ae4.exe

Resource

win7-20240705-en

wannacry defense_evasion discovery ransomware worm

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral24

Sample

0e82ed8dabc9bb697d3e2f7ba1ee8d5235d3501796fbc1cd79ccffe7df11d9a4.exe

Resource

win7-20240704-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

0e98661ea680708e9bb55f32131f743811108e826b91cae99d69a8fc1856d429.exe

Resource

win7-20240704-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

0e9f24d9b122f16a0817890872ab88e91cfddeaf1bac8a1e41a724f5eadd9ad5.exe

Resource

win7-20240704-en

ransomware

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral27

Sample

0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe

Resource

win7-20240705-en

persistence ransomware

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral28

Sample

0f18f6547a1c8e86963a9e9f9dd9e6e42bd506de21c034ec884c3b55a789ac57.exe

Resource

win7-20240704-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral29

Sample

0f3d700c95b21e5437c0aedb3cacd787ce6701c49180d8d564e4574dffc42190.exe

Resource

win7-20240705-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral30

Sample

0f54e0f3c3408647bf9844f9d97b64dbc62278091280b3d7bf1db5bdde3fc436.exe

Resource

win7-20240705-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

0f5ace8adbaf1f05d0f5765166537ff4b77ea9f038cffbc08c16afd4cc869972.exe

Resource

win7-20240704-en

persistence

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral32

Sample

0fc4a985aed460862a8f70dd982fadbd65ea0ad88fb58ced2d909f4264ab98f8.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

150 seconds

Report Analysis Logs

General

Target

0b02c55fbb40d7757b5808efe3fd1343f943bcefb92e0009689f4995e3eb26c0.exe
Size

10.0MB
MD5

ae3a625b9d6bf29b465d56502b22b7b1
SHA1

232d769ae3b52efe6c2cf831cc2880bca34d44f2
SHA256

0b02c55fbb40d7757b5808efe3fd1343f943bcefb92e0009689f4995e3eb26c0
SHA512

bc607a19544ab5d85956605917dd82baf3ebb620c036a7716cc970719b328892964aa1a3312c3864845756b38664d3e7b1a51bb54c7cae7d31d22cd4087a1390
SSDEEP

49152:FwaYoE4htZYBl+OHJ1V4dYFgZPsv97H4numCM1+7:SaYoE4htZ2p8dfZPs54numh1+

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral7/memory/2260-0-0x0000000000770000-0x0000000001170000-memory.dmp	themida

Processes

C:\Users\Admin\AppData\Local\Temp\0b02c55fbb40d7757b5808efe3fd1343f943bcefb92e0009689f4995e3eb26c0.exe
"C:\Users\Admin\AppData\Local\Temp\0b02c55fbb40d7757b5808efe3fd1343f943bcefb92e0009689f4995e3eb26c0.exe"
1⤵
PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-0-0x0000000000770000-0x0000000001170000-memory.dmp

Filesize
10.0MB

Download