Overview
overview
7Static
static
7VMProtect-...ed.exe
windows7-x64
3VMProtect-...ed.exe
windows10-2004-x64
3VMProtect-...K32.so
ubuntu-22.04-amd64
1VMProtect-...K64.so
ubuntu-22.04-amd64
1VMProtect-....dylib
macos-10.15-amd64
1VMProtect-...32.dll
windows7-x64
3VMProtect-...32.dll
windows10-2004-x64
3VMProtect-...64.dll
windows7-x64
1VMProtect-...64.dll
windows10-2004-x64
1VMProtect-...32.dll
windows7-x64
3VMProtect-...32.dll
windows10-2004-x64
3VMProtect-...64.dll
windows7-x64
1VMProtect-...64.dll
windows10-2004-x64
1VMProtect-...el.exe
windows7-x64
3VMProtect-...el.exe
windows10-2004-x64
3VMProtect-...ct.exe
windows7-x64
5VMProtect-...ct.exe
windows10-2004-x64
5VMProtect-...on.exe
windows7-x64
5VMProtect-...on.exe
windows10-2004-x64
5VMProtect-...32.dll
windows7-x64
3VMProtect-...32.dll
windows10-2004-x64
3VMProtect-...64.dll
windows7-x64
7VMProtect-...64.dll
windows10-2004-x64
7VMProtect-...or.exe
windows7-x64
3VMProtect-...or.exe
windows10-2004-x64
3VMProtect-...ib.dll
windows7-x64
1VMProtect-...ib.dll
windows10-2004-x64
1VMProtect-...st.exe
windows7-x64
1VMProtect-...st.exe
windows10-2004-x64
1VMProtect-...mp.exe
windows7-x64
7VMProtect-...mp.exe
windows10-2004-x64
7VMProtect-...K32.so
ubuntu-24.04-amd64
1Analysis
-
max time kernel
92s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 18:56
Behavioral task
behavioral1
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Confused.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Confused.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Lib/Linux/libVMProtectSDK32.so
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral4
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Lib/Linux/libVMProtectSDK64.so
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral5
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Lib/OSX/libVMProtectSDK.dylib
Resource
macos-20241101-en
Behavioral task
behavioral6
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Lib/Windows/VMProtectDDK32.dll
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Lib/Windows/VMProtectDDK32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Lib/Windows/VMProtectDDK64.dll
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Lib/Windows/VMProtectDDK64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Lib/Windows/VMProtectSDK32.dll
Resource
win7-20241023-en
Behavioral task
behavioral11
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Lib/Windows/VMProtectSDK32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Lib/Windows/VMProtectSDK64.dll
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Lib/Windows/VMProtectSDK64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Panel.exe
Resource
win7-20241010-en
Behavioral task
behavioral15
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Panel.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/VMProtect.exe
Resource
win7-20240903-en
Behavioral task
behavioral17
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/VMProtect.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/VMProtect_Con.exe
Resource
win7-20240708-en
Behavioral task
behavioral19
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/VMProtect_Con.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/VMProtect_Ext32.dll
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/VMProtect_Ext32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/VMProtect_Ext64.dll
Resource
win7-20241010-en
Behavioral task
behavioral23
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/VMProtect_Ext64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/VaporObfuscator.exe
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/VaporObfuscator.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/dnlib.dll
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/dnlib.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/test.exe
Resource
win7-20241023-en
Behavioral task
behavioral29
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/test.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/test.vmp.exe
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/test.vmp.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x86/Lib/Linux/libVMProtectSDK32.so
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
VMProtect-Ultimate--main/VMProtect Ultimate/VMProtect Ultimate x64/Confused.exe
-
Size
54KB
-
MD5
81c6a8ccd47647c4297afe20fcf87eec
-
SHA1
dbcfd866f0755363ae7733038826d7cf911e20a1
-
SHA256
cbaa687115266698f94f10cc0f7807b5f7d5ae2b734c36306bcc7dd0163c7885
-
SHA512
ed3a577ae81701cd3da8266021ff46cc86c6a4a67f37382970f821d0ecf68a7d3175a07e8ad1f0bdcb086e790462a045498e8d79c2aa06a0a2bd83dac2346c97
-
SSDEEP
384:lKhl7xFP1eWkvwKwq6uwKTdWiiirQlWN38okbJ45SzDBonYtptYcFwVc03K:eKBKuzMbdenYftYcFwVc6K
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Confused.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Confused.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VMProtect-Ultimate--main\VMProtect Ultimate\VMProtect Ultimate x64\Confused.exe"C:\Users\Admin\AppData\Local\Temp\VMProtect-Ultimate--main\VMProtect Ultimate\VMProtect Ultimate x64\Confused.exe"1⤵
- System Location Discovery: System Language Discovery
PID:728