Analysis
- max time kernel
120s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
07/01/2022, 09:06
General
- Target a4ae0ebebf0159211d1408314466d910.exe
- Size 1.4MB
- Sample220107-k2rnracear
- SHA256 6804e6d84da5db804a33138fc6d1f7e4009bb1e165cc9606862d4b3b0807042a
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4ae0ebebf0159211d1408314466d910.exe"C:\Users\Admin\AppData\Local\Temp\a4ae0ebebf0159211d1408314466d910.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 5362⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/784-156-0x0000000000400000-0x0000000000420000-memory.dmp
memory/784-169-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/784-171-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/784-175-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/784-375-0x000000000BD30000-0x000000000BEF2000-memory.dmp
memory/784-194-0x000000000A750000-0x000000000A76E000-memory.dmp
memory/784-193-0x000000000AD10000-0x000000000ADA2000-memory.dmp
memory/784-192-0x000000000A660000-0x000000000A6D6000-memory.dmp
memory/784-191-0x0000000009A90000-0x0000000009AF6000-memory.dmp
memory/784-188-0x000000000A770000-0x000000000AC6E000-memory.dmp
memory/784-184-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/784-183-0x0000000009770000-0x00000000097BB000-memory.dmp
memory/784-182-0x0000000009730000-0x000000000976E000-memory.dmp
memory/784-181-0x0000000009650000-0x0000000009C56000-memory.dmp
memory/784-180-0x0000000009800000-0x000000000990A000-memory.dmp
memory/784-179-0x00000000096D0000-0x00000000096E2000-memory.dmp
memory/784-178-0x0000000009C60000-0x000000000A266000-memory.dmp
memory/784-177-0x0000000000400000-0x0000000000420000-memory.dmp
memory/784-176-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3376-146-0x0000000002810000-0x0000000002811000-memory.dmp
memory/3376-155-0x00000000029B0000-0x00000000029B1000-memory.dmp
memory/3376-133-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/3376-134-0x0000000000400000-0x0000000000729000-memory.dmp
memory/3376-135-0x0000000002680000-0x0000000002681000-memory.dmp
memory/3376-132-0x0000000000400000-0x0000000000729000-memory.dmp
memory/3376-137-0x0000000002700000-0x0000000002701000-memory.dmp
memory/3376-138-0x0000000002720000-0x0000000002721000-memory.dmp
memory/3376-136-0x00000000026A0000-0x00000000026A1000-memory.dmp
memory/3376-139-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/3376-140-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/3376-141-0x0000000002830000-0x0000000002831000-memory.dmp
memory/3376-142-0x0000000002840000-0x0000000002841000-memory.dmp
memory/3376-143-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/3376-144-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3376-145-0x0000000002820000-0x0000000002821000-memory.dmp
memory/3376-130-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/3376-147-0x0000000002890000-0x0000000002891000-memory.dmp
memory/3376-148-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/3376-149-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/3376-150-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/3376-151-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/3376-152-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/3376-153-0x0000000002670000-0x0000000002671000-memory.dmp
memory/3376-154-0x00000000029A0000-0x00000000029A1000-memory.dmp
memory/3376-131-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/3376-157-0x0000000002960000-0x0000000002961000-memory.dmp
memory/3376-160-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/3376-162-0x0000000002990000-0x0000000002991000-memory.dmp
memory/3376-170-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/3376-168-0x0000000002670000-0x0000000002671000-memory.dmp
memory/3376-167-0x0000000002670000-0x0000000002671000-memory.dmp
memory/3376-165-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/3376-163-0x0000000002980000-0x0000000002981000-memory.dmp
memory/3376-172-0x0000000002730000-0x0000000002731000-memory.dmp
memory/3376-173-0x0000000002670000-0x0000000002671000-memory.dmp
memory/3376-125-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/3376-129-0x0000000000400000-0x0000000000729000-memory.dmp
memory/3376-128-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/3376-127-0x0000000000400000-0x0000000000729000-memory.dmp
memory/3376-126-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/3376-124-0x00000000035E0000-0x00000000035E1000-memory.dmp
memory/3376-123-0x0000000002910000-0x0000000002911000-memory.dmp
memory/3376-122-0x0000000002940000-0x0000000002941000-memory.dmp
memory/3376-121-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/3376-120-0x00000000028E0000-0x00000000028E1000-memory.dmp
memory/3376-119-0x0000000002920000-0x0000000002921000-memory.dmp
memory/3376-118-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/3376-117-0x0000000002900000-0x0000000002901000-memory.dmp
memory/3376-116-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/3376-115-0x00000000024E0000-0x0000000002540000-memory.dmp
memory/3376-174-0x0000000002670000-0x0000000002671000-memory.dmp