Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
05-12-2021 23:02
Static task
static1
Behavioral task
behavioral1
Sample
aInjector Win64_x32.exe
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
General
-
Target
aInjector Win64_x32.exe
-
Size
4.0MB
-
MD5
0633e40fa1f37b748cf61f04dba96445
-
SHA1
0710b691613be0f6ccf54f8e0bb4d8d7cf3c930c
-
SHA256
5781173908ae9208be64f02dd0e5cc0dc6ed0d98b16ae577b560b95cc136cb3d
-
SHA512
ffd608a67b60d2e02edf9e5090e18e9e0568846e10db66a7b0ce5ce8414acf19c4aa82b7dcab5c9a9fd341ff4e194df4938d8ce3cf5e9bb18040d7aa9a00ab94
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
aInjector Win64_x32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion aInjector Win64_x32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion aInjector Win64_x32.exe -
Processes:
resource yara_rule behavioral2/memory/2752-119-0x0000000000E10000-0x0000000000E11000-memory.dmp themida -
Processes:
aInjector Win64_x32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA aInjector Win64_x32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
aInjector Win64_x32.exepid process 2752 aInjector Win64_x32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
aInjector Win64_x32.exedescription pid process Token: SeDebugPrivilege 2752 aInjector Win64_x32.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2752-118-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/2752-119-0x0000000000E10000-0x0000000000E11000-memory.dmpFilesize
4KB
-
memory/2752-121-0x0000000005AE0000-0x0000000005B3A000-memory.dmpFilesize
360KB
-
memory/2752-122-0x0000000003720000-0x0000000003721000-memory.dmpFilesize
4KB
-
memory/2752-123-0x0000000005BA0000-0x0000000005BA1000-memory.dmpFilesize
4KB
-
memory/2752-124-0x0000000005D20000-0x0000000005D21000-memory.dmpFilesize
4KB
-
memory/2752-125-0x00000000072E0000-0x00000000072E1000-memory.dmpFilesize
4KB
-
memory/2752-126-0x0000000006A20000-0x0000000006A21000-memory.dmpFilesize
4KB