e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc

General

Target

e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
Size

11.9MB
MD5

cfc98c934014d81551196915988f195c
SHA1

f63859d2e9562c3f9c24ba991d8ee2b17b584b54
SHA256

e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc
SHA512

282179793fe4cf9124fbad25692c4a54bd836c2cd3ad0727b52c4b8ed2abd16a1b37a849c9672c13c8221ff98a0dcfaead7dc60ec94a7c2baf484841a3aba21c
SSDEEP

196608:2Wurfits94M7g4s6gZXe7eGTXGeECHhrmnbIsTAV4RfyM17n:2prj9n7U6gY7ZXGn8hyn8sMV4RfygL

Score

7^/10

discovery upx vmprotect

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2388-53-0x0000000003560000-0x0000000003587000-memory.dmp	upx

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2388-44-0x0000000000400000-0x0000000001B2A000-memory.dmp	vmprotect
behavioral1/memory/2388-16-0x0000000000400000-0x0000000001B2A000-memory.dmp	vmprotect
behavioral1/memory/2388-45-0x0000000000400000-0x0000000001B2A000-memory.dmp	vmprotect
behavioral1/memory/2388-54-0x0000000000400000-0x0000000001B2A000-memory.dmp	vmprotect
behavioral1/memory/2388-55-0x0000000000400000-0x0000000001B2A000-memory.dmp	vmprotect
behavioral1/memory/2388-58-0x0000000000400000-0x0000000001B2A000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
2388	e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe

C:\Users\Admin\AppData\Local\Temp\e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe
"C:\Users\Admin\AppData\Local\Temp\e12f69390564f347d2014df771d4f77b7782b6fd4d1bcf5fe45a056496d937bc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2388-0-0x0000000000B7D000-0x0000000000F3B000-memory.dmp

Filesize
3.7MB

Download
memory/2388-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2388-44-0x0000000000400000-0x0000000001B2A000-memory.dmp

Filesize
23.2MB

Download
memory/2388-41-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2388-39-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2388-37-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2388-36-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2388-34-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2388-32-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2388-31-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2388-29-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2388-26-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2388-24-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2388-21-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2388-19-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2388-16-0x0000000000400000-0x0000000001B2A000-memory.dmp

Filesize
23.2MB

Download
memory/2388-15-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2388-13-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2388-10-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2388-8-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2388-6-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2388-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2388-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2388-45-0x0000000000400000-0x0000000001B2A000-memory.dmp

Filesize
23.2MB

Download
memory/2388-46-0x0000000004450000-0x0000000004CB4000-memory.dmp

Filesize
8.4MB

Download
memory/2388-49-0x0000000004450000-0x0000000004CB4000-memory.dmp

Filesize
8.4MB

Download
memory/2388-53-0x0000000003560000-0x0000000003587000-memory.dmp

Filesize
156KB

Download
memory/2388-54-0x0000000000400000-0x0000000001B2A000-memory.dmp

Filesize
23.2MB

Download
memory/2388-55-0x0000000000400000-0x0000000001B2A000-memory.dmp

Filesize
23.2MB

Download
memory/2388-56-0x0000000004450000-0x0000000004CB4000-memory.dmp

Filesize
8.4MB

Download
memory/2388-57-0x0000000000B7D000-0x0000000000F3B000-memory.dmp

Filesize
3.7MB

Download
memory/2388-58-0x0000000000400000-0x0000000001B2A000-memory.dmp

Filesize
23.2MB

Download

Analysis

Sharing