Analysis

  • max time kernel
    41s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/09/2024, 19:06

General

  • Target

    Vape Launcher.exe

  • Size

    60.3MB

  • MD5

    73ea53e2da8be95a006d7ba6dd4f0534

  • SHA1

    880809840d5a6744943e768d8ac021e28dcf8e15

  • SHA256

    319a145536f32881604eaf8ed2a20de6d2f496ff5229d9ad92eafc64314acf64

  • SHA512

    65c36fe3e1fc6d0d4a5ba52812d8c6fa74207dc25adab4f321c916cc777ce5fc17d9c12277d273981f8e0642d7054b677a5dbd9467cb4f54a431dc57c74500f3

  • SSDEEP

    1572864:i99RQ4pTVQR8lN2S0qicZIYbXJ++ZdNeEcFBqUFmg:itPxmRevM3EGsU0g

Score
9/10

Malware Config

Signatures

  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vape Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Vape Launcher.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5000

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/5000-0-0x00007FF80A8D3000-0x00007FF80A8D5000-memory.dmp

          Filesize

          8KB

        • memory/5000-1-0x0000023CF64F0000-0x0000023CFA14A000-memory.dmp

          Filesize

          60.4MB

        • memory/5000-2-0x0000023CFC670000-0x0000023CFC7E6000-memory.dmp

          Filesize

          1.5MB

        • memory/5000-3-0x00007FF80A8D0000-0x00007FF80B392000-memory.dmp

          Filesize

          10.8MB

        • memory/5000-4-0x0000023CFBE10000-0x0000023CFBE42000-memory.dmp

          Filesize

          200KB

        • memory/5000-5-0x0000023CFDB80000-0x0000023CFDB9C000-memory.dmp

          Filesize

          112KB

        • memory/5000-6-0x0000023CFDBA0000-0x0000023CFDBA6000-memory.dmp

          Filesize

          24KB

        • memory/5000-7-0x00007FF80A8D0000-0x00007FF80B392000-memory.dmp

          Filesize

          10.8MB

        • memory/5000-8-0x00007FF80A8D0000-0x00007FF80B392000-memory.dmp

          Filesize

          10.8MB

        • memory/5000-9-0x00007FF80A8D0000-0x00007FF80B392000-memory.dmp

          Filesize

          10.8MB

        • memory/5000-10-0x00007FF80A8D3000-0x00007FF80A8D5000-memory.dmp

          Filesize

          8KB

        • memory/5000-11-0x00007FF80A8D0000-0x00007FF80B392000-memory.dmp

          Filesize

          10.8MB

        • memory/5000-12-0x00007FF80A8D0000-0x00007FF80B392000-memory.dmp

          Filesize

          10.8MB

        • memory/5000-13-0x00007FF80A8D0000-0x00007FF80B392000-memory.dmp

          Filesize

          10.8MB

        • memory/5000-14-0x00007FF80A8D0000-0x00007FF80B392000-memory.dmp

          Filesize

          10.8MB