Overview

overview

8

Static

static

7

72d91c1097...74.exe

windows7-x64

8

72d91c1097...74.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 00:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    72d91c1097bbd5add3a340f90a80f22335dbe189a9c46ba62c0f785e974ce874.exe

  • Size

    2.1MB

  • MD5

    139ac913cd6ac595f6dec94254790157

  • SHA1

    7f4a89f6781072b1b6488c38b71a107fca66db77

  • SHA256

    72d91c1097bbd5add3a340f90a80f22335dbe189a9c46ba62c0f785e974ce874

  • SHA512

    8664266bf89847124ac7a7e2617ad76054ad8fc4528cb6f3997f08243426c7cdc4c800bd9dd58db580357b0a00feb36cd6e7c21ed2905873bfb8d440d32b7af3

  • SSDEEP

    49152:2m5EhIg5yWJojkJBLz6ktns98U5hbx1JJQ:2mWh9yGykJ9Js98ah11Jq

Score
8/10
discoveryvmprotect

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: LoadsDriver 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72d91c1097bbd5add3a340f90a80f22335dbe189a9c46ba62c0f785e974ce874.exe
    "C:\Users\Admin\AppData\Local\Temp\72d91c1097bbd5add3a340f90a80f22335dbe189a9c46ba62c0f785e974ce874.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabDBFF.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarDC50.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\smzuhIf7UBYBt.sys
    Filesize

    100KB

    MD5

    b78512a09b506b7af9ea08d64ff16e08

    SHA1

    e6b79ac77ca72cacdcd1556e29af0fe949bfd89f

    SHA256

    91bd0ecb80d5ce3fafda7bda4a092f7beefff012f07c458a0056ca6363e7e3b1

    SHA512

    ea19f980269995f399a949ebd5e2dbde3dcd6b203e911dc1718e6223973540c44ffc82781ff3434448b5ae5f9367e115c98f5e904e46f5512cd8e0f44ab62d6d

    Download Submit

  • memory/2108-0-0x0000000000250000-0x000000000038A000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2108-1-0x0000000000250000-0x000000000038A000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2108-103-0x0000000000250000-0x000000000038A000-memory.dmp

    Filesize

    1.2MB

    Download