Behavioral task
behavioral1
Sample
triggerbot.vmp.exe
Resource
win11-20240802-en
General
-
Target
triggerbot.vmp.exe
-
Size
5.6MB
-
MD5
51bb5648242d3da626cc6d84ff0ed161
-
SHA1
81828e33f8a3a1511b410edbda8ab0e942272bce
-
SHA256
46a7278e4c9b7e007d8573d094cf3ce1f8872eb097e2548a57cc0cdb36034cb6
-
SHA512
adbfd434e7d907d2d2ebaedb392ed15f8f0eb9835e9cdba42560aa1e11396b031b43bff70831c476f7c87f744491dd73c2e702bf8c7e25c03f2684a1cec4143b
-
SSDEEP
98304:B3us0hqqeezuqCkKcIZjpKPBmT+WuMn8Di1IO/vSQ30jzNvUTdHWq:B7LjmC3RpKPBmTuMnz1/qQk6Uq
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource triggerbot.vmp.exe
Files
-
triggerbot.vmp.exe.exe windows:6 windows x64 arch:x64
90a446112aa678ea9129ebf88b68adca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
TranslateMessage
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
kernel32
GetTimeZoneInformation
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
ConvertSidToStringSidW
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 172KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 263KB - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ