7126b9932dc0cdfe751340edfa7c4a14b69262eb1afd0530e6d1fdb2e25986dd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$R9/NsCpuCNMiner32.exe
Size

1.4MB
MD5

3afeb8e9af02a33ff71bf2f6751cae3a
SHA1

fd358cfe41c7aa3aa9e4cf62f832d8ae6baa8107
SHA256

a0eba3fda0d7b22a5d694105ec700df7c7012ddc4ae611c3071ef858e2c69f08
SHA512

11a2c12d7384d2743d25b9e28fc4ea0c3e2771aca92875fd3350f457df66c66827d175f67108f1a56d958f3b1163f3a89eedb8919bf7973d037241a1e59231d5
SSDEEP

24576:gWKqa4hnzP3w7L3rmZmpk7FSQFW2iJ+N07/TwYV1CdZdQ+4lT+iFgiGTtswAtdz:gSrwf3aZmpOFU2iQNIUc1LxGTtswgd

Score

7^/10

discovery vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral7/memory/3056-0-0x00000000013B0000-0x00000000016F9000-memory.dmp	vmprotect
behavioral7/memory/3056-1-0x00000000013B0000-0x00000000016F9000-memory.dmp	vmprotect
behavioral7/memory/3056-4-0x00000000013B0000-0x00000000016F9000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

NsCpuCNMiner32.exe

pid process

3056 NsCpuCNMiner32.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

NsCpuCNMiner32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NsCpuCNMiner32.exe

pid	process
3056	NsCpuCNMiner32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NsCpuCNMiner32.exe

C:\Users\Admin\AppData\Local\Temp\$R9\NsCpuCNMiner32.exe
"C:\Users\Admin\AppData\Local\Temp\$R9\NsCpuCNMiner32.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:3056

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-0-0x00000000013B0000-0x00000000016F9000-memory.dmp

Filesize
3.3MB

Download
memory/3056-1-0x00000000013B0000-0x00000000016F9000-memory.dmp

Filesize
3.3MB

Download
memory/3056-4-0x00000000013B0000-0x00000000016F9000-memory.dmp

Filesize
3.3MB

Download