751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d

General

Target
751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe
Size 938KB
Sample201109-dev6phhchx
SHA256 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d
MD5 c59fe051332fdb1e97e7e804f5bf7823
SHA1 db5a236ee9abcc089d90e6aef13c8b9d7c3cb677
SHA512 408dee8cf804aad41ad0d1013a8dbc052708861b22d6ba08922da541ed2e52e9362b90932e7fe133bd967bed5a54567c87ae4976eea7a177378852a6d366a9ae
MD5 SHA1 SHA512

Score

9^/10

evasion upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1384-4-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1384-6-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1384-7-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1620-8-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Wine	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 1384	1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe
1620	calc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1384	1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	29
PID 1668 wrote to memory of 1384	1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	29
PID 1668 wrote to memory of 1384	1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	29
PID 1668 wrote to memory of 1384	1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	29
PID 1668 wrote to memory of 1384	1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	29
PID 1668 wrote to memory of 1384	1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	29
PID 1668 wrote to memory of 1384	1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	29
PID 1668 wrote to memory of 1384	1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	29
PID 1668 wrote to memory of 1384	1668	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	29
PID 1384 wrote to memory of 1620	1384	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	30
PID 1384 wrote to memory of 1620	1384	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	30
PID 1384 wrote to memory of 1620	1384	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	30
PID 1384 wrote to memory of 1620	1384	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	30
PID 1384 wrote to memory of 1620	1384	751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe	30

C:\Users\Admin\AppData\Local\Temp\751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe
"C:\Users\Admin\AppData\Local\Temp\751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe"
1⤵
- Drops startup file
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe
  "C:\Users\Admin\AppData\Local\Temp\751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-4-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1384-6-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1384-7-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1440-10-0x000007FEF6780000-0x000007FEF69FA000-memory.dmp

Download

memory/1620-8-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1668-1-0x00000000040A0000-0x00000000040B1000-memory.dmp

Download

memory/1668-0-0x0000000003C90000-0x0000000003CA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads