7c2bcbc90aad473e93b52051f11b1c1d8f3d9436b7d95b49e1ca4c7c835b0115

Analysis

max time kernel
132s
max time network
139s
platform
windows7_x64
resource
win7
submitted
28/08/2020, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KQ9ANQ7ME18REPVHLNCMILN379K394QKLJE9ZZX.dll
Size 10.4MB
Sample200828-he1chgecex
SHA256 7c2bcbc90aad473e93b52051f11b1c1d8f3d9436b7d95b49e1ca4c7c835b0115
MD5 6ba8f89d3e1f1e95e115f824cd469c06
SHA1 ddd6386bcd0c59c1b5fd1fab95175a4d6188a3bf
SHA512 6f766366214d97f5c2ed7761240e379914e82d326c43dc3d82b45e62f2b37ecc2fb8e62dfd7e56251409758cc95d09ebb5cf19adaec65aa2c1c0d470d4e9fda9
MD5 SHA1 SHA512

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rundll32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1448	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	1448	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1900	WerFault.exe
1900	WerFault.exe
1900	WerFault.exe
1900	WerFault.exe
1900	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1900	1448	rundll32.exe	27
PID 1448 wrote to memory of 1900	1448	rundll32.exe	27
PID 1448 wrote to memory of 1900	1448	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KQ9ANQ7ME18REPVHLNCMILN379K394QKLJE9ZZX.dll,#1
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1448 -s 584
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-0-0x0000000001DA0000-0x00000000036A3000-memory.dmp

Download

memory/1448-1-0x0000000001DA0000-0x00000000036A3000-memory.dmp

Download

memory/1900-3-0x0000000001DD0000-0x0000000001DE1000-memory.dmp

Download

memory/1900-4-0x0000000002B40000-0x0000000002B51000-memory.dmp

Download