dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4

Analysis

max time kernel
140s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe
Size 939KB
Sample201109-ramxxma7e6
SHA256 dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4
MD5 07403678fc78fa1a457d5fc49f2636da
SHA1 acda90434b1b5a99b0958cd35273c350e590e1ef
SHA512 a40082a3076d48cc1290012d4c15f862538ea84d4b21d273c432198c3c08de8c46f9323cbbdb107366c15ec6ac1295243210c0d623fad059ede97fb5cb23835e
MD5 SHA1 SHA512

Score

9^/10

evasion upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1372-4-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1372-6-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/1372-7-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/3492-8-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Wine	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1056 set thread context of 1372	1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	76

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe
1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe
3492	calc.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1372	1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	76
PID 1056 wrote to memory of 1372	1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	76
PID 1056 wrote to memory of 1372	1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	76
PID 1056 wrote to memory of 1372	1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	76
PID 1056 wrote to memory of 1372	1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	76
PID 1056 wrote to memory of 1372	1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	76
PID 1056 wrote to memory of 1372	1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	76
PID 1056 wrote to memory of 1372	1056	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	76
PID 1372 wrote to memory of 3380	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	77
PID 1372 wrote to memory of 3380	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	77
PID 1372 wrote to memory of 3380	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	77
PID 1372 wrote to memory of 4092	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	78
PID 1372 wrote to memory of 4092	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	78
PID 1372 wrote to memory of 4092	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	78
PID 1372 wrote to memory of 3836	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	79
PID 1372 wrote to memory of 3836	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	79
PID 1372 wrote to memory of 3836	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	79
PID 1372 wrote to memory of 3404	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	80
PID 1372 wrote to memory of 3404	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	80
PID 1372 wrote to memory of 3404	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	80
PID 1372 wrote to memory of 3384	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	81
PID 1372 wrote to memory of 3384	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	81
PID 1372 wrote to memory of 3384	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	81
PID 1372 wrote to memory of 3844	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	82
PID 1372 wrote to memory of 3844	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	82
PID 1372 wrote to memory of 3844	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	82
PID 1372 wrote to memory of 3492	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	83
PID 1372 wrote to memory of 3492	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	83
PID 1372 wrote to memory of 3492	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	83
PID 1372 wrote to memory of 3492	1372	dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe	83

C:\Users\Admin\AppData\Local\Temp\dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe
"C:\Users\Admin\AppData\Local\Temp\dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe"
1⤵
- Drops startup file
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe
  "C:\Users\Admin\AppData\Local\Temp\dec8034e880b3ea1bdbc16f358c8fdfecf119d6159d7dcce065ecb173697dbf4.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    PID:4092
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    PID:3836
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    PID:3404
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    PID:3844
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-0-0x00000000042A0000-0x00000000042A1000-memory.dmp

Download

memory/1056-1-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Download

memory/1372-4-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1372-6-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/1372-7-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download

memory/3492-8-0x0000000000C80000-0x0000000000C96000-memory.dmp

Download