Analysis
- max time kernel
141s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
22/07/2024, 17:04
General
- Target b577e8823c7582f8b548683203b6458b93d873cfc82eeb363b46198abeee5dc3.exe
- Size 390KB
- Sample240722-vlsafsxfrf
- SHA256 b577e8823c7582f8b548683203b6458b93d873cfc82eeb363b46198abeee5dc3
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 10 IoCs
- VMProtect packed file 6 IoCs
Detects executables packed with VMProtect commercial packer.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 10 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b577e8823c7582f8b548683203b6458b93d873cfc82eeb363b46198abeee5dc3.exe"C:\Users\Admin\AppData\Local\Temp\b577e8823c7582f8b548683203b6458b93d873cfc82eeb363b46198abeee5dc3.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\h73uurix9nriyub\spower.exeC:\Users\Admin\AppData\Local\Temp\h73uurix9nriyub\spower.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\h73uurix9nriyub\upssvc.exeC:\Users\Admin\AppData\Local\Temp\h73uurix9nriyub\upssvc.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\ProgramData\NVIDIARV\svchost.exeC:\ProgramData\NVIDIARV\svchost.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
-
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC ONLOGON /TN WindowsUpdata /F /RL HIGHEST /TR C:\Users\Public\Picturestgjktof0\CCCef3Render.exe2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Program Files\Microvirt\MEmuHyperv\mesvc.exe"C:\Program Files\Microvirt\MEmuHyperv\mesvc.exe" -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
MEmuDDU.dll
MEmuRT.dll
MSVCP100.dll
MSVCR100.dll
libcrypto-1_1-x64.dll
libcurl.dll
libssl-1_1-x64.dll
mesvc.exe
svchost.exe
spower.exe
upssvc.exe
memory/1088-24-0x00000000046B0000-0x00000000046B1000-memory.dmp
memory/1088-39-0x00000000032C0000-0x00000000032C1000-memory.dmp
memory/1088-13-0x00000000055A0000-0x00000000055A1000-memory.dmp
memory/1088-14-0x00000000059A0000-0x00000000059A1000-memory.dmp
memory/1088-15-0x0000000005B10000-0x0000000005B11000-memory.dmp
memory/1088-17-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/1088-16-0x0000000005DB0000-0x0000000005DB1000-memory.dmp
memory/1088-0-0x0000000000400000-0x0000000000518000-memory.dmp
memory/1088-23-0x00000000062C0000-0x00000000062C1000-memory.dmp
memory/1088-22-0x0000000005970000-0x0000000005971000-memory.dmp
memory/1088-21-0x0000000005E10000-0x0000000005E11000-memory.dmp
memory/1088-27-0x0000000006280000-0x0000000006281000-memory.dmp
memory/1088-28-0x00000000062A0000-0x00000000062A1000-memory.dmp
memory/1088-29-0x0000000004760000-0x0000000004761000-memory.dmp
memory/1088-34-0x00000000052B0000-0x00000000052B1000-memory.dmp
memory/1088-53-0x0000000004130000-0x0000000004131000-memory.dmp
memory/1088-60-0x0000000004790000-0x0000000004791000-memory.dmp
memory/1088-63-0x00000000032F0000-0x00000000032F1000-memory.dmp
memory/1088-62-0x0000000006380000-0x0000000006381000-memory.dmp
memory/1088-59-0x00000000062F0000-0x00000000062F1000-memory.dmp
memory/1088-57-0x00000000041E0000-0x00000000041E1000-memory.dmp
memory/1088-56-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/1088-52-0x0000000005290000-0x0000000005291000-memory.dmp
memory/1088-51-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
memory/1088-50-0x0000000005260000-0x0000000005261000-memory.dmp
memory/1088-47-0x0000000003630000-0x0000000003631000-memory.dmp
memory/1088-46-0x0000000005230000-0x0000000005231000-memory.dmp
memory/1088-45-0x0000000005AF0000-0x0000000005AF1000-memory.dmp
memory/1088-44-0x00000000051D0000-0x00000000051D1000-memory.dmp
memory/1088-41-0x0000000005580000-0x0000000005581000-memory.dmp
memory/1088-40-0x0000000005170000-0x0000000005171000-memory.dmp
memory/1088-7-0x00000000046D0000-0x00000000046D1000-memory.dmp
memory/1088-38-0x0000000006300000-0x0000000006301000-memory.dmp
memory/1088-33-0x00000000062E0000-0x00000000062E1000-memory.dmp
memory/1088-30-0x00000000035B0000-0x00000000035B1000-memory.dmp
memory/1088-66-0x00000000052B0000-0x00000000053B0000-memory.dmp
memory/1088-65-0x00000000062E0000-0x00000000062E1000-memory.dmp
memory/1088-104-0x0000000006390000-0x0000000006391000-memory.dmp
memory/1088-193-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/1088-12-0x00000000052D0000-0x00000000052D1000-memory.dmp
memory/1088-10-0x0000000004E90000-0x0000000004E91000-memory.dmp
memory/1088-11-0x0000000005020000-0x0000000005021000-memory.dmp
memory/1088-9-0x0000000004560000-0x0000000004561000-memory.dmp
memory/1088-8-0x0000000004780000-0x0000000004781000-memory.dmp
memory/1088-6-0x0000000004150000-0x0000000004151000-memory.dmp
memory/1088-5-0x0000000003E70000-0x0000000003E71000-memory.dmp
memory/1088-4-0x0000000003620000-0x0000000003621000-memory.dmp
memory/1088-213-0x00000000052B0000-0x00000000053B0000-memory.dmp
memory/1088-3-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/1088-243-0x0000000000400000-0x0000000000518000-memory.dmp
memory/1088-2-0x00000000032E0000-0x00000000032E1000-memory.dmp
memory/1088-223-0x0000000006390000-0x0000000006391000-memory.dmp
memory/1088-235-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/1088-1-0x0000000003230000-0x0000000003231000-memory.dmp
memory/1088-229-0x0000000006290000-0x0000000006291000-memory.dmp
memory/1416-228-0x00007FF6A9E70000-0x00007FF6A9EBC000-memory.dmp
memory/1416-224-0x00007FF6A9E70000-0x00007FF6A9EBC000-memory.dmp
memory/4404-236-0x0000000000400000-0x0000000000508000-memory.dmp
memory/4404-244-0x0000000000400000-0x0000000000508000-memory.dmp
memory/5004-240-0x00007FF71D610000-0x00007FF71D849000-memory.dmp
memory/5004-218-0x00007FF71D610000-0x00007FF71D849000-memory.dmp