Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2024, 03:33

General

  • Target

    3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe

  • Size

    10.3MB

  • MD5

    50fbdcd4027ed3c8c8b342bb4a2317e6

  • SHA1

    c5e0e2dd10802831acffc8d1dc48057af85f810b

  • SHA256

    3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee

  • SHA512

    003f71eddbd4482d445d1f50eddf0162ef9c324777d71c4dc5d2c241e56ce930cec1d81c8e43c26092c597055987d3d025330a501429f8a52ac0921a9f321e9c

  • SSDEEP

    196608:AADRDH5DD3DQZ72NPO8R3BVXgh2+1uaaYiYzWotD0/NBnk4o1pDaPAvDDYWiXTt:3DRVsZmTfgJKYnd0/NtsQUYRXB

Malware Config

Signatures

  • VMProtect packed file 14 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe
    "C:\Users\Admin\AppData\Local\Temp\3f2353ee7ad7388e30080f6ff13d5150debdb5510897861a51663e2edc4e00ee.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3132

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3132-0-0x00000000016C0000-0x00000000016C1000-memory.dmp

    Filesize

    4KB

  • memory/3132-1-0x0000000003280000-0x0000000003281000-memory.dmp

    Filesize

    4KB

  • memory/3132-7-0x00000000032F0000-0x00000000032F1000-memory.dmp

    Filesize

    4KB

  • memory/3132-8-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-6-0x0000000000692000-0x0000000000D62000-memory.dmp

    Filesize

    6.8MB

  • memory/3132-5-0x00000000032E0000-0x00000000032E1000-memory.dmp

    Filesize

    4KB

  • memory/3132-4-0x00000000032D0000-0x00000000032D1000-memory.dmp

    Filesize

    4KB

  • memory/3132-3-0x00000000032C0000-0x00000000032C1000-memory.dmp

    Filesize

    4KB

  • memory/3132-11-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-13-0x0000000003690000-0x00000000036B6000-memory.dmp

    Filesize

    152KB

  • memory/3132-12-0x0000000003660000-0x0000000003686000-memory.dmp

    Filesize

    152KB

  • memory/3132-2-0x0000000003290000-0x0000000003291000-memory.dmp

    Filesize

    4KB

  • memory/3132-14-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-15-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-16-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-17-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-18-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-19-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-20-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-21-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-22-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-23-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-24-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB

  • memory/3132-25-0x0000000000400000-0x0000000001540000-memory.dmp

    Filesize

    17.2MB