Overview

overview

7

Static

static

5

_Getintopc...13.rar

windows10-2004-x64

7

_Getintopc...13.rar

windows11-21h2-x64

1

Resubmissions

16/04/2026, 09:27

260416-lezxaae14t7

16/04/2026, 09:24

260416-ldhxdaby7j5

Analysis

  • user interaction
    yes
  • max time kernel
    123s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/04/2026, 09:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _Getintopc.com_VMProtect_ULTIMATE_3.5.0_Build_1213.rar
  • Size 39.6MB
  • Sample260416-lezxaae14t
  • SHA256 71ca87bb1f9fab55b6e931fa33117d6b83e05b8135ccfc73dc75bd7eed8a3469
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
upxvmprotect

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\_Getintopc.com_VMProtect_ULTIMATE_3.5.0_Build_1213.rar"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1720
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4836
    • C:\Users\Admin\Desktop\VMProtect_ULTIMATE_3.5.0_Build_1213\VMProtect.exe
      "C:\Users\Admin\Desktop\VMProtect_ULTIMATE_3.5.0_Build_1213\VMProtect.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3576
      • C:\Users\Admin\Desktop\VMProtect_ULTIMATE_3.5.0_Build_1213\VMProtect_Con.vmp.exe
        "C:\Users\Admin\Desktop\VMProtect_ULTIMATE_3.5.0_Build_1213\VMProtect_Con.vmp.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:5092

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VMProtectSDK32.lib
          • Path C:\Users\Admin\AppData\Local\Temp\7zE8B66AF08\VMProtect_ULTIMATE_3.5.0_Build_1213\Example\Code Markers\BCB\VMProtectSDK32.lib
          • Size 7KB
          • SHA256 9278d85fde55f645cafc39946b1832985b85fb6aac23938edf0c6d5ad3027109
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VMProtectSDK32.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zE8B66AF08\VMProtect_ULTIMATE_3.5.0_Build_1213\Example\Code Markers\Delphi\VMProtectSDK32.dll
          • Size 98KB
          • SHA256 b2dd017dd8bf60e5a439a202af9e4dbd8a4bf57d72e6dc7528484c6f34eadc8e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libVMProtectSDK.dylib
          • Path C:\Users\Admin\AppData\Local\Temp\7zE8B66AF08\VMProtect_ULTIMATE_3.5.0_Build_1213\Example\Code Markers\Free Pascal\libVMProtectSDK.dylib
          • Size 49KB
          • SHA256 42a1f34f87ee3f435a97dee1aefd1a9576bdc5fc8186ff3f1530a8cfa29655ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VMProtectSDK.pas
          • Path C:\Users\Admin\AppData\Local\Temp\7zE8B66AF08\VMProtect_ULTIMATE_3.5.0_Build_1213\Example\Code Markers\Lazarus\VMProtectSDK.pas
          • Size 9KB
          • SHA256 569305da70e1d8a6f933c333b9e39362a2628fd2e939771046d1af19de3c7960
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          project1.exe.vmp
          • Path C:\Users\Admin\AppData\Local\Temp\7zE8B66AF08\VMProtect_ULTIMATE_3.5.0_Build_1213\Example\Code Markers\Lazarus\project1.exe.vmp
          • Size 804B
          • SHA256 50f1d138f273381a9f20e5de3ae21e863196b632baa6953e54f4b2316569c535
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VMProtectSDK64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zE8B66AF08\VMProtect_ULTIMATE_3.5.0_Build_1213\Example\Code Markers\MASM\VMProtectSDK64.dll
          • Size 116KB
          • SHA256 ae22254e2b5c5557f35a170696d53e847018221dcd4cc70c153c36ecdd891f81
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VMProtectSDK64.lib
          • Path C:\Users\Admin\AppData\Local\Temp\7zE8B66AF08\VMProtect_ULTIMATE_3.5.0_Build_1213\Example\Code Markers\MASM\VMProtectSDK64.lib
          • Size 7KB
          • SHA256 c8c4c4d824b42ff38b05bd9f8f3781a63b9318baef087e4e9cf694ac4844a20d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VMProtectSDK.h
          • Path C:\Users\Admin\AppData\Local\Temp\7zE8B66AF08\VMProtect_ULTIMATE_3.5.0_Build_1213\Example\Code Markers\MinGW\VMProtectSDK.h
          • Size 3KB
          • SHA256 a58e33e21b3e9ff7392f38b67967efb173ab42ea5b46b2d24e4803c7aff0e68f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VMProtect.SDK.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zE8B66AF08\VMProtect_ULTIMATE_3.5.0_Build_1213\Example\Licensing\Net\bin\VMProtect.SDK.dll
          • Size 10KB
          • SHA256 d684207ae6a5a816aca628d644455d806cb78b5a2e23bd44603220dc0627279c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VMProtectSDK.bas
          • Path C:\Users\Admin\AppData\Local\Temp\7zE8B66AF08\VMProtect_ULTIMATE_3.5.0_Build_1213\Example\Licensing\VB6\VMProtectSDK.bas
          • Size 3KB
          • SHA256 d2c1334fd893071b3b7e42d0817cbd37310c831af2af12ee1f94e8f654eff403
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          InfoPlist.strings
          • Path C:\Users\Admin\AppData\Local\Temp\7zE8B66AF08\VMProtect_ULTIMATE_3.5.0_Build_1213\Example\Licensing\Xcode\en.lproj\InfoPlist.strings
          • Size 47B
          • SHA256 2a7f77dd390052d5407e2b494b173a9fc6b671ab757d25b79ed23352361dce5c
          • MD5 SHA1 SHA512
          Submit Download

          Project1.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zE8B66AF08\VMProtect_ULTIMATE_3.5.0_Build_1213\Example\Scripts\Environment Variables\Project1.exe
          • Size 3KB
          • SHA256 7e90ae83789d2a44ec9c5ee5b38586e5898dcbfefb0e754af6fd0720eea21dde
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vmpBDDD.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\vmpBDDD.tmp
          • Size 496KB
          • SHA256 12885f6c53ccf290cce203ff83895cb98bdfee83cbdb25f3a9bdd05d099b8397
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VMProtect.exe
          • Path C:\Users\Admin\Desktop\VMProtect_ULTIMATE_3.5.0_Build_1213\VMProtect.exe
          • Size 21.2MB
          • SHA256 ed52c0528c245d9bb8281a0ed23b68ca32ccabf2756df6838f4816d13bfbdcc2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VMProtect_Con.exe
          • Path C:\Users\Admin\Desktop\VMProtect_ULTIMATE_3.5.0_Build_1213\VMProtect_Con.exe
          • Size 12.8MB
          • SHA256 6c7d58b61c0127f07ad2c99fe760d3e4acc75119754497cc75035c62ef53e2ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VMProtect_Con.vmp.exe
          • Path C:\Users\Admin\Desktop\VMProtect_ULTIMATE_3.5.0_Build_1213\VMProtect_Con.vmp.exe
          • Size 17.6MB
          • SHA256 14c4b2f496f2caf04952498af4b3e700d2694e79b8b16bcf230e3e28c2d27449
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en.lng
          • Path C:\Users\Admin\Desktop\VMProtect_ULTIMATE_3.5.0_Build_1213\langs\en.lng
          • Size 9KB
          • SHA256 cf6b7752aeb778a85ce5822c01cb298f47250e74df2925311abd890a113cd9af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unins000.exe
          • Path C:\Users\Admin\Desktop\VMProtect_ULTIMATE_3.5.0_Build_1213\unins000.exe
          • Size 1.1MB
          • SHA256 73bb6b0d30a4c0dc8aa2e51de155df7c906b6435d38901dae22a85bbea6582ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3576-610-0x00007FF7851C0000-0x00007FF788F24000-memory.dmp
          Download

          memory/3576-609-0x00007FFC85120000-0x00007FFC85122000-memory.dmp
          Download

          memory/3576-608-0x00007FFC85110000-0x00007FFC85112000-memory.dmp
          Download

          memory/5092-639-0x00007FFC85110000-0x00007FFC85112000-memory.dmp
          Download

          memory/5092-640-0x00007FF6FA6A0000-0x00007FF6FD9F6000-memory.dmp
          Download