7c2bcbc90aad473e93b52051f11b1c1d8f3d9436b7d95b49e1ca4c7c835b0115

General

Target
KQ9ANQ7ME18REPVHLNCMILN379K394QKLJE9ZZX.dll
Size 10.4MB
Sample200828-he1chgecex
SHA256 7c2bcbc90aad473e93b52051f11b1c1d8f3d9436b7d95b49e1ca4c7c835b0115
MD5 6ba8f89d3e1f1e95e115f824cd469c06
SHA1 ddd6386bcd0c59c1b5fd1fab95175a4d6188a3bf
SHA512 6f766366214d97f5c2ed7761240e379914e82d326c43dc3d82b45e62f2b37ecc2fb8e62dfd7e56251409758cc95d09ebb5cf19adaec65aa2c1c0d470d4e9fda9
MD5 SHA1 SHA512

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rundll32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1468	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3676	1468	WerFault.exe	65
3864	1468	WerFault.exe	65

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = e28259213f7dd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3676	WerFault.exe
3676	WerFault.exe
3676	WerFault.exe
3676	WerFault.exe
3676	WerFault.exe
3676	WerFault.exe
3676	WerFault.exe
3676	WerFault.exe
3676	WerFault.exe
3676	WerFault.exe
3676	WerFault.exe
3676	WerFault.exe
3676	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3720	svchost.exe
Token: SeCreatePagefilePrivilege	3720	svchost.exe
Token: SeDebugPrivilege	3676	WerFault.exe
Token: SeDebugPrivilege	3864	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KQ9ANQ7ME18REPVHLNCMILN379K394QKLJE9ZZX.dll,#1
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1468
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1468 -s 724
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1468 -s 244
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-0-0x0000000000400000-0x0000000001D03000-memory.dmp

Download

memory/1468-1-0x0000000000400000-0x0000000001D03000-memory.dmp

Download

memory/3676-2-0x0000020D51750000-0x0000020D51751000-memory.dmp

Download

memory/3676-3-0x0000020D525C0000-0x0000020D525C1000-memory.dmp

Download

memory/3676-4-0x0000020D525C0000-0x0000020D525C1000-memory.dmp

Download

memory/3676-5-0x0000020D525C0000-0x0000020D525C1000-memory.dmp

Download

memory/3864-7-0x0000017B09050000-0x0000017B09051000-memory.dmp

Download

memory/3864-8-0x0000017B09DC0000-0x0000017B09DC1000-memory.dmp

Download

memory/3864-9-0x0000017B09DC0000-0x0000017B09DC1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads