Analysis

  • max time kernel
    122s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 20:19

General

  • Target

    c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe

  • Size

    15.1MB

  • MD5

    f922b9114e8db963e4bacd1aa3786b73

  • SHA1

    e4d52183700fc9f08e9715d4da311f5ab75eaea5

  • SHA256

    c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69

  • SHA512

    c93e245b7d7afd3123b4c533dab41ef6d9d13896ccbc5a3e71a9722410a6342e2851a886b569a649ca0b59960795cdf8c2fc0779f2a0df2447b8b07f9bffaf7c

  • SSDEEP

    393216:QWPBFpnQWbmFO0nwOqst0AkjMgD0Gt2DitqGJxKVh3OcrsN5S:bdfbH0nwCg3P2utqGY3OcwN5S

Malware Config

Signatures

  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 26 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe
    "C:\Users\Admin\AppData\Local\Temp\c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1412-19-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1412-35-0x0000000000360000-0x0000000000361000-memory.dmp

    Filesize

    4KB

  • memory/1412-33-0x0000000000360000-0x0000000000361000-memory.dmp

    Filesize

    4KB

  • memory/1412-31-0x0000000000360000-0x0000000000361000-memory.dmp

    Filesize

    4KB

  • memory/1412-30-0x00000000009B1000-0x0000000001165000-memory.dmp

    Filesize

    7.7MB

  • memory/1412-29-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/1412-68-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-83-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-66-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-64-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-62-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-60-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-58-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-56-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-54-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-52-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-50-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-48-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-46-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-44-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-42-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-41-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-40-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/1412-39-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-27-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/1412-24-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/1412-22-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/1412-17-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1412-14-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1412-12-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1412-9-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1412-7-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1412-5-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1412-4-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1412-2-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1412-0-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1412-86-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-87-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-88-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-89-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-90-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-91-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-92-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-93-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-94-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-95-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-96-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-97-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-98-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-99-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-100-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-101-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-102-0x00000000009B1000-0x0000000001165000-memory.dmp

    Filesize

    7.7MB

  • memory/1412-103-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-104-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-105-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-106-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-107-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-108-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-109-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB

  • memory/1412-110-0x0000000000400000-0x0000000001D5C000-memory.dmp

    Filesize

    25.4MB