Analysis
- max time kernel
100s - max time network
103s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
03/07/2025, 03:20
General
- Target VMProtect.exe
- Size 20.0MB
- Sample250703-dvtffas1hy
- SHA256 3c94c8e6ca6ea0b6f1276448be8e14ecc1c7fca8018cf5ae050f65631aa2d8d1
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VMProtect.exe"C:\Users\Admin\AppData\Local\Temp\VMProtect.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2692-0-0x00007FF67A1AE000-0x00007FF67A940000-memory.dmp
memory/2692-2-0x00007FFFC9D80000-0x00007FFFC9D82000-memory.dmp
memory/2692-1-0x00007FFFC9D70000-0x00007FFFC9D72000-memory.dmp
memory/2692-7-0x00007FF678520000-0x00007FF67BD43000-memory.dmp
memory/2692-8-0x00007FF67A1AE000-0x00007FF67A940000-memory.dmp
memory/2692-9-0x00007FF678520000-0x00007FF67BD43000-memory.dmp