General
-
Target
dllhost.exe
-
Size
1.8MB
-
Sample
210128-nka86sx582
-
MD5
51710e06bbd844ae2b0494e5c142dcbe
-
SHA1
68d8378d23edc21b09be4d56e443a4204c749b6a
-
SHA256
dc1649633cb90b8456c19c1b53675ad07d0bf2774d33b8c8f650f1e65489d6fc
-
SHA512
eac92e729da84e54c5f010f5cbf87d280a901745e19608187563229c0b0222c2b23c6571ee9843a7664cb7b245d66e961fb3f540ba0c4ddb0eb58e05b614c50c
Static task
static1
Behavioral task
behavioral1
Sample
dllhost.exe
Resource
win7v20201028
Malware Config
Targets
-
-
Target
dllhost.exe
-
Size
1.8MB
-
MD5
51710e06bbd844ae2b0494e5c142dcbe
-
SHA1
68d8378d23edc21b09be4d56e443a4204c749b6a
-
SHA256
dc1649633cb90b8456c19c1b53675ad07d0bf2774d33b8c8f650f1e65489d6fc
-
SHA512
eac92e729da84e54c5f010f5cbf87d280a901745e19608187563229c0b0222c2b23c6571ee9843a7664cb7b245d66e961fb3f540ba0c4ddb0eb58e05b614c50c
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-