Overview

overview

7

Static

static

3

vmprotect.exe

windows10-2004-x64

7

vmprotect.exe

windows11-ltsc_2024-x64

7

Resubmissions

10/07/2026, 22:55

260710-2wlc8agv8w7

10/07/2026, 22:52

260710-2tkc5sgt7s7

Analysis

  • user interaction
    yes
  • max time kernel
    112s
  • max time network
    111s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/07/2026, 22:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    vmprotect.exe
  • Size 93.4MB
  • Sample260710-2wlc8agv8w
  • SHA256 e74795a8ec29f5e8ea6f173e6f33d2ec6485930c51d636e62fe05bd92f1eb1bb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceprivilege_escalation

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 50 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vmprotect.exe
    "C:\Users\Admin\AppData\Local\Temp\vmprotect.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Users\Admin\AppData\Local\Temp\is-SUDHS.tmp\vmprotect.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-SUDHS.tmp\vmprotect.tmp" /SL5="$7009E,97503962,119296,C:\Users\Admin\AppData\Local\Temp\vmprotect.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Users\Admin\AppData\Local\Temp\is-C7FKB.tmp\_isetup\_setup64.tmp
        helper 105 0x48C
        3⤵
        • Executes dropped EXE
        PID:3188
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\VMProtect Ultimate\VMProtect_Ext32.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:836
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\VMProtect Ultimate\VMProtect_Ext64.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:4004
      • C:\Program Files\VMProtect Ultimate\VMProtect.exe
        "C:\Program Files\VMProtect Ultimate\VMProtect.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:1116

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VMProtectSDK32.lib
        • Path C:\Program Files\VMProtect Ultimate\Lib\Windows\VMProtectSDK32.lib
        • Size 7KB
        • SHA256 ee09a629c0066ae175caf97ee92bfd7bcfa58e12b29b7aa62cc88fd3f097ef4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VMProtect.exe
        • Path C:\Program Files\VMProtect Ultimate\VMProtect.exe
        • Size 29.9MB
        • SHA256 951f9bc353fb7e6b20d4ea6395ac000a22c264dda86ff09872225b8e062c5ac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VMProtect_Ext32.dll
        • Path C:\Program Files\VMProtect Ultimate\VMProtect_Ext32.dll
        • Size 203KB
        • SHA256 01e9478240d60aca380cb7d79691777c453541820a17209e673adcfb0b38a22e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VMProtect_Ext64.dll
        • Path C:\Program Files\VMProtect Ultimate\VMProtect_Ext64.dll
        • Size 226KB
        • SHA256 7a8a64284bd032fb6294cb1b7ca36840d63c04ca56945bc32b6f54b78c66c472
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en.lng
        • Path C:\Program Files\VMProtect Ultimate\langs\en.lng
        • Size 9KB
        • SHA256 a7b508ca5a0bd7b6c12a4d4388eccd5df51545d35a34308310852a3824978b33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _iscrypt.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-C7FKB.tmp\_isetup\_iscrypt.dll
        • Size 2KB
        • SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _setup64.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-C7FKB.tmp\_isetup\_setup64.tmp
        • Size 6KB
        • SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vmprotect.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-SUDHS.tmp\vmprotect.tmp
        • Size 1.1MB
        • SHA256 cb095356ddcfcbace96c6252fb73a267ed011c15ff206a7a9302007baa68a783
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VMProtectSDK.h
        • Path C:\Users\Public\Documents\VMProtect\Code Markers\BCB\VMProtectSDK.h
        • Size 3KB
        • SHA256 2300b7b4bb6bbf9cfa08013ec2d9b2fdceb3dfd2e603cd1e24a493de4d165b15
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VMProtectSDK.pas
        • Path C:\Users\Public\Documents\VMProtect\Code Markers\Delphi\VMProtectSDK.pas
        • Size 9KB
        • SHA256 935c599b59ef4e70eeb3c87a05a6cb7351e0820ecbe4b425b86d47301b1dffa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libVMProtectSDK.dylib
        • Path C:\Users\Public\Documents\VMProtect\Code Markers\GCC\libVMProtectSDK.dylib
        • Size 49KB
        • SHA256 27e726386a83680917d72557adc5b271fd3446103826c3b290e85daee9f70777
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-5RSIO.tmp
        • Path C:\Users\Public\Documents\VMProtect\Code Markers\Lazarus\is-5RSIO.tmp
        • Size 804B
        • SHA256 50f1d138f273381a9f20e5de3ae21e863196b632baa6953e54f4b2316569c535
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VMProtectSDK.inc
        • Path C:\Users\Public\Documents\VMProtect\Code Markers\MASM\VMProtectSDK.inc
        • Size 2KB
        • SHA256 9d41f7bf8f220e721e34f54665db9b63caca9ea00fc650f81492736a196f731e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VMProtectSDK32.dll
        • Path C:\Users\Public\Documents\VMProtect\Code Markers\MASM\VMProtectSDK32.dll
        • Size 98KB
        • SHA256 d53173dca9ff097049fa9b81acd177ffc9de0ff577a59efd320b630f678079a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VMProtectSDK64.dll
        • Path C:\Users\Public\Documents\VMProtect\Code Markers\MASM\VMProtectSDK64.dll
        • Size 116KB
        • SHA256 af82c309ace1ce81c23aa190c65f4eaa4e2e668e227175e66b0637b56f546796
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VMProtectSDK64.lib
        • Path C:\Users\Public\Documents\VMProtect\Code Markers\MASM\VMProtectSDK64.lib
        • Size 7KB
        • SHA256 5f7fea4dedcb9c0fb061ba7e7e27f53e3a0fe9e3a304be3d21514f751b14a791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VMProtectSDK32.a
        • Path C:\Users\Public\Documents\VMProtect\Code Markers\MinGW\VMProtectSDK32.a
        • Size 18KB
        • SHA256 e9ec7953b54c24c2cdfe2f4bd0a2feb288445ecc9d577c2e0edc4bb1f8d380c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VMProtect.SDK.dll
        • Path C:\Users\Public\Documents\VMProtect\Code Markers\Net\bin\VMProtect.SDK.dll
        • Size 10KB
        • SHA256 b8ff4bb2b247b67d707c77d32f4541c4de99ac8213aebc411fd36ab0dbd201da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VMProtectSDK.bas
        • Path C:\Users\Public\Documents\VMProtect\Code Markers\VB6\VMProtectSDK.bas
        • Size 3KB
        • SHA256 d2c1334fd893071b3b7e42d0817cbd37310c831af2af12ee1f94e8f654eff403
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VMProtectDDK.h
        • Path C:\Users\Public\Documents\VMProtect\Licensing\DDK\VMProtectDDK.h
        • Size 3KB
        • SHA256 e98615fe5506da30061c63a3c6a3b1dfd23892f783d1aa6a9e4fe891a59f2283
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VMProtectDDK32.lib
        • Path C:\Users\Public\Documents\VMProtect\Licensing\DDK\VMProtectDDK32.lib
        • Size 7KB
        • SHA256 7850eacfcecbac9b0f9b9335060f53c5b17a8d817222a0b3065c83a22d1c831d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VMProtectDDK64.lib
        • Path C:\Users\Public\Documents\VMProtect\Licensing\DDK\VMProtectDDK64.lib
        • Size 7KB
        • SHA256 2f5c114bf3bd77c53d5d493d9fd6269c0bd19674321e680da973551389d5fd90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-N11JP.tmp
        • Path C:\Users\Public\Documents\VMProtect\Licensing\Xcode\en.lproj\is-N11JP.tmp
        • Size 47B
        • SHA256 2a7f77dd390052d5407e2b494b173a9fc6b671ab757d25b79ed23352361dce5c
        • MD5 SHA1 SHA512
        Submit Download

        is-LJD0D.tmp
        • Path C:\Users\Public\Documents\VMProtect\Scripts\External DLL\is-LJD0D.tmp
        • Size 3KB
        • SHA256 7e90ae83789d2a44ec9c5ee5b38586e5898dcbfefb0e754af6fd0720eea21dde
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1116-710-0x00007FF7136D0000-0x00007FF718462000-memory.dmp
        Download

        memory/1116-709-0x00007FFE4D900000-0x00007FFE4D902000-memory.dmp
        Download

        memory/1116-708-0x00007FFE4D8F0000-0x00007FFE4D8F2000-memory.dmp
        Download

        memory/2440-707-0x0000000000400000-0x0000000000428000-memory.dmp
        Download

        memory/2440-0-0x0000000000400000-0x0000000000428000-memory.dmp
        Download

        memory/2440-13-0x0000000000400000-0x0000000000428000-memory.dmp
        Download

        memory/3948-15-0x0000000002520000-0x0000000002521000-memory.dmp
        Download

        memory/3948-706-0x0000000000400000-0x000000000052C000-memory.dmp
        Download

        memory/3948-705-0x0000000000400000-0x000000000052C000-memory.dmp
        Download

        memory/3948-14-0x0000000000400000-0x000000000052C000-memory.dmp
        Download

        memory/3948-36-0x0000000000400000-0x000000000052C000-memory.dmp
        Download

        memory/3948-5-0x0000000002520000-0x0000000002521000-memory.dmp
        Download