Analysis
- max time kernel
129s - max time network
120s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:28
General
- Target f5f22da770bfd33da2fa26f353f66a96cb4fa0304b885949db4b2b50113b090a.exe
- Size 2.0MB
- Sample201109-hmdvcsy39e
- SHA256 f5f22da770bfd33da2fa26f353f66a96cb4fa0304b885949db4b2b50113b090a
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- ServiceHost packer 36 IoCs
Detects ServiceHost packer used for .NET malware
- Executes dropped EXE 4 IoCs
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Adds Run key to start application 2 TTPs 6 IoCs
- Drops file in System32 directory 2 IoCs
- Modifies service 2 TTPs 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Drops file in Windows directory 4 IoCs
- Suspicious behavior: EnumeratesProcesses 192 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5f22da770bfd33da2fa26f353f66a96cb4fa0304b885949db4b2b50113b090a.exe"C:\Users\Admin\AppData\Local\Temp\f5f22da770bfd33da2fa26f353f66a96cb4fa0304b885949db4b2b50113b090a.exe"1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Modifies service
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Modify Existing Service
1Registry Run Keys / Startup Folder
1Defense Evasion
Hidden Files and Directories
1Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
memory/2108-58-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-159-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-239-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-231-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-233-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-227-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-224-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-218-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-220-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-216-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-215-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-204-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-210-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-209-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-203-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-201-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-200-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-197-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-195-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-190-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-189-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-183-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-236-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-243-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-43-0x0000000004F60000-0x0000000004F61000-memory.dmp
memory/2108-42-0x0000000004760000-0x0000000004761000-memory.dmp
memory/2108-47-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-48-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-49-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-50-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-52-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-51-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-54-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-53-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-55-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-56-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-57-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-245-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-60-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-59-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-64-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-62-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-63-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-65-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-66-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-67-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-68-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-69-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-70-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-71-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-72-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-73-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-74-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-75-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-76-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-77-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-78-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-184-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-177-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-251-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-248-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-178-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-171-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-173-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-167-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-164-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-61-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-161-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-155-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-153-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-146-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-149-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-140-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-142-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-137-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2108-138-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-136-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2108-135-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2824-130-0x0000000004750000-0x0000000004751000-memory.dmp
memory/2824-131-0x0000000004F50000-0x0000000004F51000-memory.dmp
memory/3292-182-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-172-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-121-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-122-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-123-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-124-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-125-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-126-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-127-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-119-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-116-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-249-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-118-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-115-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-114-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-113-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-112-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-141-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-143-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-111-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-110-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-108-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-147-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-109-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-107-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-148-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-106-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-104-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-105-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-103-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-154-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-152-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-160-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-102-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-101-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-100-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-158-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-99-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-166-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-98-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-97-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-165-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-96-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-95-0x0000000004860000-0x0000000004861000-memory.dmp
memory/3292-91-0x0000000005060000-0x0000000005061000-memory.dmp
memory/3292-170-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-90-0x0000000004860000-0x0000000004861000-memory.dmp
memory/3292-179-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-250-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-176-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-185-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-242-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-244-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-191-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-120-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3292-117-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3292-238-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-188-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-237-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-230-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-196-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-194-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-232-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-225-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-207-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-226-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-205-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-221-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-219-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3292-213-0x0000000006700000-0x0000000006701000-memory.dmp
memory/3292-211-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3824-83-0x0000000004F50000-0x0000000004F51000-memory.dmp
memory/3824-82-0x0000000004750000-0x0000000004751000-memory.dmp
memory/3940-16-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-26-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-21-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-27-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-20-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-19-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-18-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-28-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-17-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-29-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-14-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-30-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-31-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-15-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-23-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-32-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-33-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-11-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-25-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-12-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-35-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-13-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-36-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-10-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-9-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-8-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-7-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-38-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-34-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-24-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-22-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-6-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/3940-37-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-5-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3940-1-0x0000000005090000-0x0000000005091000-memory.dmp
memory/3940-0-0x0000000004890000-0x0000000004891000-memory.dmp