General
- Target aa50acd8116fddaaeec779efeab5555a.exe
- Size 1.6MB
- Sample210920-rad2xaghhm
- SHA256 39f5b13c60418f4bcefdd1df075a6fe9e8bd879340c42d12c8a5e636aa035e6d
Score
10/10
Malware Config
Targets
-
- Target aa50acd8116fddaaeec779efeab5555a.exe
- Size 1.6MB
- SHA256 39f5b13c60418f4bcefdd1df075a6fe9e8bd879340c42d12c8a5e636aa035e6d
Score10/10Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Themida packer
Detects Themida, an advanced Windows software protection system.
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext