Analysis
-
max time kernel
73s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-10-2021 23:11
General
-
Target
97f8f7a08a23c4119347e1ac94b3fdaf.exe
-
Size
2.6MB
-
MD5
97f8f7a08a23c4119347e1ac94b3fdaf
-
SHA1
5268ac027ae7436f0f4f342f6f1a39f3f02db118
-
SHA256
6e98fc5ea72ba14a5606fa481a46ced465d64c915f122bed42f7fad7cd9056f6
-
SHA512
e4c9422b1a22fdac9ede3eafb0523556cd2252ae65aff63ac82d221e56c9a20b91b04be4a95134474058993c8ea4853805edb001f9b38aea72221da6ee0aab8d
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97f8f7a08a23c4119347e1ac94b3fdaf.exe"C:\Users\Admin\AppData\Local\Temp\97f8f7a08a23c4119347e1ac94b3fdaf.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1836-117-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/1836-118-0x0000000000F20000-0x0000000000F21000-memory.dmpFilesize
4KB
-
memory/1836-120-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB
-
memory/1836-121-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/1836-122-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/1836-123-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/1836-124-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/1836-125-0x00000000054D0000-0x00000000054D1000-memory.dmpFilesize
4KB
-
memory/1836-126-0x0000000006880000-0x0000000006881000-memory.dmpFilesize
4KB
-
memory/1836-127-0x0000000006720000-0x0000000006721000-memory.dmpFilesize
4KB
-
memory/1836-128-0x0000000006B50000-0x0000000006B51000-memory.dmpFilesize
4KB
-
memory/1836-129-0x0000000006BD0000-0x0000000006BD1000-memory.dmpFilesize
4KB
-
memory/1836-130-0x0000000007170000-0x0000000007171000-memory.dmpFilesize
4KB
-
memory/1836-131-0x0000000006DB0000-0x0000000006DB1000-memory.dmpFilesize
4KB
-
memory/1836-132-0x0000000007110000-0x0000000007111000-memory.dmpFilesize
4KB
-
memory/1836-133-0x0000000008D20000-0x0000000008D21000-memory.dmpFilesize
4KB