Analysis
- max time kernel
25s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
06/04/2021, 11:19
General
- Target Setup.exe
- Size 4.0MB
- Sample210406-czv84penps
- SHA256 a1d1febdafdc6b6f86d0c8949ee4e34157fb1e5cea1ff7d63bdce0900a3478b6
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1032-3-0x0000000077D14000-0x0000000077D15000-memory.dmp
memory/1032-4-0x0000000073690000-0x0000000073D7E000-memory.dmp
memory/1032-5-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/1032-7-0x0000000005700000-0x0000000005701000-memory.dmp
memory/1032-8-0x0000000005880000-0x0000000005881000-memory.dmp
memory/1032-9-0x0000000005CA0000-0x0000000005CA1000-memory.dmp
memory/1032-10-0x0000000006470000-0x0000000006471000-memory.dmp
memory/1032-11-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/1032-12-0x0000000005F60000-0x0000000005F61000-memory.dmp
memory/1032-13-0x0000000005FA0000-0x0000000005FA1000-memory.dmp
memory/1032-14-0x0000000006200000-0x0000000006201000-memory.dmp
memory/1032-15-0x0000000006F90000-0x0000000006F91000-memory.dmp
memory/1032-16-0x0000000007690000-0x0000000007691000-memory.dmp
memory/1032-17-0x0000000007400000-0x0000000007401000-memory.dmp
memory/1032-18-0x00000000080C0000-0x00000000080C1000-memory.dmp
memory/1032-19-0x00000000074A0000-0x00000000074A1000-memory.dmp
memory/1032-20-0x0000000007E60000-0x0000000007E61000-memory.dmp
memory/1032-21-0x0000000007F50000-0x0000000007F51000-memory.dmp