85fdd8dac21e71ad98916d2941637c882e1f39cd5255c72a9fe9436aec7f650c

Analysis

max time kernel
23s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rm2.vmp.exe
Size

11.4MB
MD5

9a722b5590def62024a8b857709b784b
SHA1

a31b8e1fd4da40b98c16d3012df463e8488347e2
SHA256

85fdd8dac21e71ad98916d2941637c882e1f39cd5255c72a9fe9436aec7f650c
SHA512

0607723c183271fcbd8dc636c080bc5c5ade147afe4a91c129516db07278b07475595a5ee1ad1ecb4ecfa04127418fec93e44b86ab35217a02acd9580205903c
SSDEEP

196608:aU9rGneSo1G/SkVqdqgJ/JIGHsjpsXuoN2miWqoYxq/NQFO5Is7RkH4:F5tSoJh/JIGusXuoN2miWYq/2wzR

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2308	rm2.vmp.exe
2308	rm2.vmp.exe
2308	rm2.vmp.exe
2308	rm2.vmp.exe
2308	rm2.vmp.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2988	2308	rm2.vmp.exe	32
PID 2308 wrote to memory of 2988	2308	rm2.vmp.exe	32
PID 2308 wrote to memory of 2988	2308	rm2.vmp.exe	32
PID 2308 wrote to memory of 2388	2308	rm2.vmp.exe	33
PID 2308 wrote to memory of 2388	2308	rm2.vmp.exe	33
PID 2308 wrote to memory of 2388	2308	rm2.vmp.exe	33
PID 2308 wrote to memory of 1872	2308	rm2.vmp.exe	34
PID 2308 wrote to memory of 1872	2308	rm2.vmp.exe	34
PID 2308 wrote to memory of 1872	2308	rm2.vmp.exe	34
PID 2308 wrote to memory of 2192	2308	rm2.vmp.exe	35
PID 2308 wrote to memory of 2192	2308	rm2.vmp.exe	35
PID 2308 wrote to memory of 2192	2308	rm2.vmp.exe	35
PID 2308 wrote to memory of 2764	2308	rm2.vmp.exe	36
PID 2308 wrote to memory of 2764	2308	rm2.vmp.exe	36
PID 2308 wrote to memory of 2764	2308	rm2.vmp.exe	36
PID 2308 wrote to memory of 2112	2308	rm2.vmp.exe	37
PID 2308 wrote to memory of 2112	2308	rm2.vmp.exe	37
PID 2308 wrote to memory of 2112	2308	rm2.vmp.exe	37
PID 2308 wrote to memory of 2896	2308	rm2.vmp.exe	38
PID 2308 wrote to memory of 2896	2308	rm2.vmp.exe	38
PID 2308 wrote to memory of 2896	2308	rm2.vmp.exe	38
PID 2308 wrote to memory of 2916	2308	rm2.vmp.exe	39
PID 2308 wrote to memory of 2916	2308	rm2.vmp.exe	39
PID 2308 wrote to memory of 2916	2308	rm2.vmp.exe	39
PID 2308 wrote to memory of 2312	2308	rm2.vmp.exe	40
PID 2308 wrote to memory of 2312	2308	rm2.vmp.exe	40
PID 2308 wrote to memory of 2312	2308	rm2.vmp.exe	40
PID 2308 wrote to memory of 2752	2308	rm2.vmp.exe	41
PID 2308 wrote to memory of 2752	2308	rm2.vmp.exe	41
PID 2308 wrote to memory of 2752	2308	rm2.vmp.exe	41

C:\Users\Admin\AppData\Local\Temp\rm2.vmp.exe
"C:\Users\Admin\AppData\Local\Temp\rm2.vmp.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-5-0x000000013FE27000-0x00000001404E3000-memory.dmp

Filesize
6.7MB

Download
memory/2308-4-0x00000000770F0000-0x00000000770F2000-memory.dmp

Filesize
8KB

Download
memory/2308-2-0x00000000770F0000-0x00000000770F2000-memory.dmp

Filesize
8KB

Download
memory/2308-6-0x000000013FDF0000-0x0000000141052000-memory.dmp

Filesize
18.4MB

Download
memory/2308-0-0x00000000770F0000-0x00000000770F2000-memory.dmp

Filesize
8KB

Download
memory/2308-10-0x000000013FDF0000-0x0000000141052000-memory.dmp

Filesize
18.4MB

Download
memory/2308-11-0x000000013FE27000-0x00000001404E3000-memory.dmp

Filesize
6.7MB

Download
memory/2308-12-0x000000013FDF0000-0x0000000141052000-memory.dmp

Filesize
18.4MB

Download