3db0f3352de578f24371004e90784f0209236a45ad7ab37ff281bb2be7a32170

Resubmissions

08/07/2026, 15:04

260708-sfvsaagz5x7

08/07/2026, 15:03

260708-se57mahz8p7

Analysis

user interaction
yes
max time kernel
32s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Intel.exe
Size 5.9MB
Sample260708-sfvsaagz5x
SHA256 3db0f3352de578f24371004e90784f0209236a45ad7ab37ff281bb2be7a32170
MD5 4c4b2d1fb6e29cc9cdc351fcddd32f26
SHA1 61c674964f076d24b24ce992bc588a2283033fdc
SHA512 23b2965263b378c507abfd8735c0f4a94e2a93f00a231e91d36eca0bf6ecc3144fb60350a15e05d2f150eae21ec764711909873a47ddf393b8c5b8d370e803fe
SSDEEP 98304:42qh6670V33lOyyhqM/dpb+7nNorblLWt9QXOyA9DCI7PUa+QA2IWz4/h:+V+33lOyyMMj6h8FLIDb8QLz4
TLSH
T16F5612FD6244335CC45B84348527FD48B1B5842D0AEE99FAB2EB6FD0776B860DA06F42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2596-3-0x00007FF6C55B0000-0x00007FF6C6031000-memory.dmp	vmprotect
behavioral1/memory/2596-8-0x00007FF6C55B0000-0x00007FF6C6031000-memory.dmp	vmprotect
behavioral1/memory/2596-13-0x00007FF6C55B0000-0x00007FF6C6031000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2596	Intel.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2416	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2596	Intel.exe
2596	Intel.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1480	2596	Intel.exe	85
PID 1480 wrote to memory of 3228	1480	cmd.exe	86
PID 1480 wrote to memory of 3748	1480	cmd.exe	87
PID 1480 wrote to memory of 4248	1480	cmd.exe	88
PID 2596 wrote to memory of 4116	2596	Intel.exe	102
PID 4116 wrote to memory of 2416	4116	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\Intel.exe
"C:\Users\Admin\AppData\Local\Temp\Intel.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Intel.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Intel.exe" MD5
    3⤵
    PID:3228
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3748
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /IM blackshot.exe /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\taskkill.exe
    taskkill /IM blackshot.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2596-0-0x00007FF6C56BB000-0x00007FF6C5A50000-memory.dmp

Download

memory/2596-3-0x00007FF6C55B0000-0x00007FF6C6031000-memory.dmp

Download

memory/2596-2-0x00007FFC67E20000-0x00007FFC67E22000-memory.dmp

Download

memory/2596-1-0x00007FFC67E10000-0x00007FFC67E12000-memory.dmp

Download

memory/2596-7-0x00007FF6C56BB000-0x00007FF6C5A50000-memory.dmp

Download

memory/2596-8-0x00007FF6C55B0000-0x00007FF6C6031000-memory.dmp

Download

memory/2596-12-0x00007FF6C56BB000-0x00007FF6C5A50000-memory.dmp

Download

memory/2596-13-0x00007FF6C55B0000-0x00007FF6C6031000-memory.dmp

Download