Analysis
- max time kernel
117s - max time network
117s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
07/01/2022, 09:06
General
- Target a4ae0ebebf0159211d1408314466d910.exe
- Size 1.4MB
- Sample220107-k2rnracear
- SHA256 6804e6d84da5db804a33138fc6d1f7e4009bb1e165cc9606862d4b3b0807042a
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4ae0ebebf0159211d1408314466d910.exe"C:\Users\Admin\AppData\Local\Temp\a4ae0ebebf0159211d1408314466d910.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/316-107-0x0000000000400000-0x0000000000420000-memory.dmp
memory/316-108-0x0000000000400000-0x0000000000420000-memory.dmp
memory/316-114-0x0000000000400000-0x0000000000420000-memory.dmp
memory/316-115-0x0000000000400000-0x0000000000420000-memory.dmp
memory/316-119-0x00000000004E0000-0x00000000004E1000-memory.dmp
memory/316-118-0x0000000000400000-0x0000000000420000-memory.dmp
memory/316-117-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1504-79-0x0000000002300000-0x0000000002301000-memory.dmp
memory/1504-84-0x00000000022E0000-0x00000000022E1000-memory.dmp
memory/1504-59-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/1504-60-0x0000000002680000-0x0000000002681000-memory.dmp
memory/1504-61-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/1504-62-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/1504-64-0x0000000002710000-0x0000000002711000-memory.dmp
memory/1504-63-0x00000000026A0000-0x00000000026A1000-memory.dmp
memory/1504-66-0x00000000033B0000-0x00000000033B1000-memory.dmp
memory/1504-65-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/1504-67-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1504-68-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1504-70-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1504-71-0x0000000000760000-0x0000000000761000-memory.dmp
memory/1504-72-0x0000000000770000-0x0000000000771000-memory.dmp
memory/1504-69-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1504-73-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/1504-74-0x0000000000740000-0x0000000000741000-memory.dmp
memory/1504-75-0x0000000000790000-0x0000000000791000-memory.dmp
memory/1504-76-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/1504-77-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1504-78-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1504-58-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/1504-81-0x00000000022C0000-0x00000000022C1000-memory.dmp
memory/1504-80-0x0000000002310000-0x0000000002311000-memory.dmp
memory/1504-83-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/1504-82-0x0000000002330000-0x0000000002331000-memory.dmp
memory/1504-57-0x0000000000360000-0x00000000003C0000-memory.dmp
memory/1504-86-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1504-87-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1504-85-0x0000000002660000-0x0000000002661000-memory.dmp
memory/1504-89-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1504-88-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1504-91-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/1504-90-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1504-93-0x0000000002780000-0x0000000002781000-memory.dmp
memory/1504-94-0x0000000002730000-0x0000000002731000-memory.dmp
memory/1504-95-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/1504-92-0x0000000002770000-0x0000000002771000-memory.dmp
memory/1504-97-0x0000000002750000-0x0000000002751000-memory.dmp
memory/1504-96-0x0000000002760000-0x0000000002761000-memory.dmp
memory/1504-99-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/1504-98-0x00000000027C0000-0x00000000027C1000-memory.dmp
memory/1504-100-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/1504-101-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/1504-56-0x0000000000400000-0x0000000000729000-memory.dmp
memory/1504-55-0x0000000000400000-0x0000000000729000-memory.dmp
memory/1504-54-0x0000000076451000-0x0000000076453000-memory.dmp
memory/1504-102-0x00000000007C0000-0x00000000007C1000-memory.dmp
memory/1504-103-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/1504-104-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/1504-106-0x0000000000400000-0x0000000000729000-memory.dmp
memory/1504-105-0x0000000000400000-0x0000000000729000-memory.dmp