Analysis
- max time kernel
103s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
- submitted
09/07/2025, 00:50
General
- Target Vvmrg.scr.exe
- Size 3.4MB
- Sample250709-a67knaskv7
- SHA256 f67f2fa47b7335ecfbfc059f1639f688321457a7a847c8d9f5156f35ac5ce814
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 40 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"C:\Users\Admin\AppData\Local\Temp\Vvmrg.scr.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5456-0-0x0000000000A50000-0x0000000000DC6000-memory.dmp
memory/5456-1-0x0000000005DA0000-0x0000000006344000-memory.dmp
memory/5456-2-0x00000000058E0000-0x0000000005972000-memory.dmp
memory/5456-3-0x0000000005A40000-0x0000000005D5C000-memory.dmp
memory/5456-4-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-9-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-13-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-11-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-7-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-5-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-17-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-15-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-37-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-41-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-39-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-49-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-55-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-53-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-51-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-47-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-45-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-43-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-35-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-33-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-29-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-31-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-27-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-25-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-23-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-21-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-19-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-57-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-71-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-61-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-59-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-103-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-91-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-87-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-81-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-79-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-77-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-75-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-73-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-69-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-67-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-65-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-63-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-125-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-129-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-127-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-123-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-121-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-117-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-115-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-113-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-111-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-109-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-119-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-107-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-105-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-101-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-99-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-97-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-95-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-93-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-89-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-85-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-83-0x0000000005A40000-0x0000000005D57000-memory.dmp
memory/5456-6014-0x0000000005A30000-0x0000000005A40000-memory.dmp
memory/5456-6015-0x00000000065A0000-0x00000000065A1000-memory.dmp
memory/5456-6016-0x0000000006920000-0x00000000069C2000-memory.dmp
memory/5456-6017-0x00000000069C0000-0x0000000006A60000-memory.dmp
memory/5456-6018-0x0000000006890000-0x00000000068DC000-memory.dmp
memory/5456-6019-0x0000000005A30000-0x0000000005A40000-memory.dmp
memory/5456-6020-0x0000000006AA0000-0x0000000006AF4000-memory.dmp