Analysis
-
max time kernel
26s -
max time network
26s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-12-2021 13:01
Static task
static1
General
-
Target
GhostDbD.exe
-
Size
7.7MB
-
MD5
182042a7af19081451220fa1475b146b
-
SHA1
223dbee35e6138a8d63a1dcf0e9167ddf06eecb7
-
SHA256
c175b965e61f8406f064adf209c5f675b4260f3fd01a81cf574611030cdd0799
-
SHA512
5de061f6f73276098322b43ec8f71f9fe80a2f089dd55cc6b0d969b93fa03f8bee34a54c7d32d83fcb2a6c5b8c24aea16fda2404b65733b81e8a1d849d347835
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
GhostDbD.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GhostDbD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion GhostDbD.exe -
Processes:
resource yara_rule behavioral1/memory/2464-118-0x0000000000910000-0x0000000001B9A000-memory.dmp themida behavioral1/memory/2464-119-0x0000000000910000-0x0000000001B9A000-memory.dmp themida -
Processes:
GhostDbD.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GhostDbD.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
GhostDbD.exepid process 2464 GhostDbD.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
GhostDbD.exedescription pid process Token: SeDebugPrivilege 2464 GhostDbD.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2464-118-0x0000000000910000-0x0000000001B9A000-memory.dmpFilesize
18.5MB
-
memory/2464-119-0x0000000000910000-0x0000000001B9A000-memory.dmpFilesize
18.5MB
-
memory/2464-120-0x00000000775A0000-0x000000007772E000-memory.dmpFilesize
1.6MB
-
memory/2464-121-0x0000000006B60000-0x000000000705E000-memory.dmpFilesize
5.0MB
-
memory/2464-122-0x0000000006660000-0x00000000066F2000-memory.dmpFilesize
584KB
-
memory/2464-123-0x0000000006570000-0x0000000006602000-memory.dmpFilesize
584KB
-
memory/2464-124-0x0000000006620000-0x000000000662A000-memory.dmpFilesize
40KB
-
memory/2464-125-0x0000000000400000-0x00000000004C8000-memory.dmpFilesize
800KB
-
memory/2464-126-0x00000000071E0000-0x0000000007356000-memory.dmpFilesize
1.5MB
-
memory/2464-127-0x0000000006AD0000-0x0000000006B02000-memory.dmpFilesize
200KB
-
memory/2464-128-0x0000000008A60000-0x0000000008AFC000-memory.dmpFilesize
624KB
-
memory/2464-129-0x0000000010000000-0x000000001001A000-memory.dmpFilesize
104KB
-
memory/2464-130-0x0000000010000000-0x000000001001A000-memory.dmpFilesize
104KB
-
memory/2464-131-0x0000000006570000-0x0000000006602000-memory.dmpFilesize
584KB
-
memory/2464-132-0x000000000C350000-0x000000000C3FA000-memory.dmpFilesize
680KB