Analysis
- max time kernel
148s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
02/10/2021, 07:16
General
- Target 6271df2fada287e2a1126123ddaf2f21.exe
- Size 2.3MB
- Sample211002-h3t46aeaep
- SHA256 455f27d80de4e45fd405ae467ed2a7b9f8a1e050a27833d79b9ce05a6d72cef4
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6271df2fada287e2a1126123ddaf2f21.exe"C:\Users\Admin\AppData\Local\Temp\6271df2fada287e2a1126123ddaf2f21.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1456-115-0x00000000772E0000-0x000000007746E000-memory.dmp
memory/1456-116-0x00000000001D0000-0x00000000001D1000-memory.dmp
memory/1456-118-0x0000000005890000-0x0000000005891000-memory.dmp
memory/1456-119-0x0000000005300000-0x0000000005301000-memory.dmp
memory/1456-120-0x0000000005430000-0x0000000005431000-memory.dmp
memory/1456-121-0x0000000005360000-0x0000000005361000-memory.dmp
memory/1456-122-0x0000000003260000-0x0000000003261000-memory.dmp
memory/1456-123-0x00000000053A0000-0x00000000053A1000-memory.dmp
memory/1456-124-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1456-125-0x0000000007320000-0x0000000007321000-memory.dmp
memory/1456-126-0x0000000007850000-0x0000000007851000-memory.dmp
memory/1456-127-0x0000000006DF0000-0x0000000006DF1000-memory.dmp
memory/1456-128-0x0000000006E70000-0x0000000006E71000-memory.dmp
memory/1456-129-0x0000000006F30000-0x0000000006F31000-memory.dmp
memory/1456-130-0x0000000007240000-0x0000000007241000-memory.dmp
memory/1456-131-0x0000000008250000-0x0000000008251000-memory.dmp