Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 18:58
Static task
static1
General
-
Target
144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exe
-
Size
3.2MB
-
MD5
e300c3575a1c0bc99ae171dd090eb079
-
SHA1
64b92a3e742180b5b6c24fc58b228a78b79ab4a9
-
SHA256
144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed
-
SHA512
c2153212816f5f637a5cb7ea17058dfe55540081fd04326beecee2fe0560305cf5a96e74f3d2c3a76a24b90f69aad40d237966e7f4d5b688a3d9cfc362103705
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/3596-117-0x0000000000B70000-0x0000000000B71000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exepid process 3596 144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exepid process 3596 144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exe 3596 144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exe 3596 144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exe 3596 144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exedescription pid process Token: SeDebugPrivilege 3596 144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exe"C:\Users\Admin\AppData\Local\Temp\144bbe3142c06ba68536cc17dddaba7aff8dfaf0ee27357a213ba24ddcafceed.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3596-115-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/3596-117-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/3596-119-0x0000000006730000-0x0000000006731000-memory.dmpFilesize
4KB
-
memory/3596-120-0x00000000060F0000-0x00000000060F1000-memory.dmpFilesize
4KB
-
memory/3596-121-0x0000000006230000-0x0000000006231000-memory.dmpFilesize
4KB
-
memory/3596-122-0x0000000006160000-0x0000000006161000-memory.dmpFilesize
4KB
-
memory/3596-123-0x0000000006110000-0x0000000006111000-memory.dmpFilesize
4KB
-
memory/3596-124-0x00000000061A0000-0x00000000061A1000-memory.dmpFilesize
4KB
-
memory/3596-125-0x00000000077E0000-0x00000000077E1000-memory.dmpFilesize
4KB
-
memory/3596-126-0x0000000007EE0000-0x0000000007EE1000-memory.dmpFilesize
4KB
-
memory/3596-127-0x0000000008910000-0x0000000008911000-memory.dmpFilesize
4KB
-
memory/3596-128-0x0000000007AA0000-0x0000000007AA1000-memory.dmpFilesize
4KB
-
memory/3596-129-0x0000000007CD0000-0x0000000007CD1000-memory.dmpFilesize
4KB
-
memory/3596-130-0x0000000007DF0000-0x0000000007DF1000-memory.dmpFilesize
4KB
-
memory/3596-131-0x0000000007DB0000-0x0000000007DB1000-memory.dmpFilesize
4KB
-
memory/3596-132-0x0000000008F90000-0x0000000008F91000-memory.dmpFilesize
4KB