Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 12:01
Static task
static1
Behavioral task
behavioral1
Sample
7e80c2ae5587b824d8230e782089e86b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7e80c2ae5587b824d8230e782089e86b.exe
Resource
win10-en-20211208
General
-
Target
7e80c2ae5587b824d8230e782089e86b.exe
-
Size
6.3MB
-
MD5
7e80c2ae5587b824d8230e782089e86b
-
SHA1
90f0912a29b9cc7a55bd4b561e1a574e005cecf6
-
SHA256
43d66e78f5334cc183e22aa29c64a9fdf4356e5a0c5052489fd7edc127460a6c
-
SHA512
db0e42e94976b9fe4d75a502b0a32f3ec4e6b993de02781ccef11a4aebc0fb0cedf1d43cd2280faa186edb66ff869f2b883f091889958625081b1a97cde5203a
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
RegHost.exeRegHost.exepid process 1992 RegHost.exe 676 RegHost.exe -
Processes:
resource yara_rule behavioral1/memory/524-59-0x0000000140000000-0x000000014274C000-memory.dmp upx behavioral1/memory/524-60-0x0000000140000000-0x000000014274C000-memory.dmp upx behavioral1/memory/524-61-0x0000000140000000-0x000000014274C000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
7e80c2ae5587b824d8230e782089e86b.exeRegHost.exeRegHost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7e80c2ae5587b824d8230e782089e86b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7e80c2ae5587b824d8230e782089e86b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RegHost.exe -
Loads dropped DLL 3 IoCs
Processes:
explorer.exeexplorer.exepid process 972 explorer.exe 972 explorer.exe 1492 explorer.exe -
Processes:
resource yara_rule behavioral1/memory/1928-55-0x000000013FD10000-0x0000000140659000-memory.dmp themida behavioral1/memory/1928-56-0x000000013FD10000-0x0000000140659000-memory.dmp themida behavioral1/memory/1928-57-0x000000013FD10000-0x0000000140659000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida \Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida \Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida behavioral1/memory/1992-77-0x000000013F1B0000-0x000000013FAF9000-memory.dmp themida behavioral1/memory/1992-78-0x000000013F1B0000-0x000000013FAF9000-memory.dmp themida behavioral1/memory/1992-79-0x000000013F1B0000-0x000000013FAF9000-memory.dmp themida \Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida behavioral1/memory/676-97-0x000000013F6E0000-0x0000000140029000-memory.dmp themida behavioral1/memory/676-98-0x000000013F6E0000-0x0000000140029000-memory.dmp themida behavioral1/memory/676-99-0x000000013F6E0000-0x0000000140029000-memory.dmp themida -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
7e80c2ae5587b824d8230e782089e86b.exeRegHost.exeRegHost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" 7e80c2ae5587b824d8230e782089e86b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" RegHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" RegHost.exe -
Processes:
7e80c2ae5587b824d8230e782089e86b.exeRegHost.exeRegHost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7e80c2ae5587b824d8230e782089e86b.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegHost.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
7e80c2ae5587b824d8230e782089e86b.exeRegHost.exeRegHost.exedescription pid process target process PID 1928 set thread context of 524 1928 7e80c2ae5587b824d8230e782089e86b.exe bfsvc.exe PID 1928 set thread context of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1992 set thread context of 1244 1992 RegHost.exe bfsvc.exe PID 1992 set thread context of 1492 1992 RegHost.exe explorer.exe PID 676 set thread context of 1748 676 RegHost.exe bfsvc.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
explorer.exeexplorer.exepid process 972 explorer.exe 972 explorer.exe 972 explorer.exe 972 explorer.exe 972 explorer.exe 1492 explorer.exe 1492 explorer.exe 1492 explorer.exe 1492 explorer.exe 1492 explorer.exe 1492 explorer.exe 1492 explorer.exe 1492 explorer.exe 1492 explorer.exe 1492 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7e80c2ae5587b824d8230e782089e86b.exeexplorer.exeRegHost.exeexplorer.exeRegHost.exedescription pid process target process PID 1928 wrote to memory of 524 1928 7e80c2ae5587b824d8230e782089e86b.exe bfsvc.exe PID 1928 wrote to memory of 524 1928 7e80c2ae5587b824d8230e782089e86b.exe bfsvc.exe PID 1928 wrote to memory of 524 1928 7e80c2ae5587b824d8230e782089e86b.exe bfsvc.exe PID 1928 wrote to memory of 524 1928 7e80c2ae5587b824d8230e782089e86b.exe bfsvc.exe PID 1928 wrote to memory of 524 1928 7e80c2ae5587b824d8230e782089e86b.exe bfsvc.exe PID 1928 wrote to memory of 524 1928 7e80c2ae5587b824d8230e782089e86b.exe bfsvc.exe PID 1928 wrote to memory of 524 1928 7e80c2ae5587b824d8230e782089e86b.exe bfsvc.exe PID 1928 wrote to memory of 524 1928 7e80c2ae5587b824d8230e782089e86b.exe bfsvc.exe PID 1928 wrote to memory of 524 1928 7e80c2ae5587b824d8230e782089e86b.exe bfsvc.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 1928 wrote to memory of 972 1928 7e80c2ae5587b824d8230e782089e86b.exe explorer.exe PID 972 wrote to memory of 1992 972 explorer.exe RegHost.exe PID 972 wrote to memory of 1992 972 explorer.exe RegHost.exe PID 972 wrote to memory of 1992 972 explorer.exe RegHost.exe PID 1992 wrote to memory of 1244 1992 RegHost.exe bfsvc.exe PID 1992 wrote to memory of 1244 1992 RegHost.exe bfsvc.exe PID 1992 wrote to memory of 1244 1992 RegHost.exe bfsvc.exe PID 1992 wrote to memory of 1244 1992 RegHost.exe bfsvc.exe PID 1992 wrote to memory of 1244 1992 RegHost.exe bfsvc.exe PID 1992 wrote to memory of 1244 1992 RegHost.exe bfsvc.exe PID 1992 wrote to memory of 1244 1992 RegHost.exe bfsvc.exe PID 1992 wrote to memory of 1244 1992 RegHost.exe bfsvc.exe PID 1992 wrote to memory of 1244 1992 RegHost.exe bfsvc.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1992 wrote to memory of 1492 1992 RegHost.exe explorer.exe PID 1492 wrote to memory of 676 1492 explorer.exe RegHost.exe PID 1492 wrote to memory of 676 1492 explorer.exe RegHost.exe PID 1492 wrote to memory of 676 1492 explorer.exe RegHost.exe PID 676 wrote to memory of 1748 676 RegHost.exe bfsvc.exe PID 676 wrote to memory of 1748 676 RegHost.exe bfsvc.exe PID 676 wrote to memory of 1748 676 RegHost.exe bfsvc.exe PID 676 wrote to memory of 1748 676 RegHost.exe bfsvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e80c2ae5587b824d8230e782089e86b.exe"C:\Users\Admin\AppData\Local\Temp\7e80c2ae5587b824d8230e782089e86b.exe"1⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAP2qRJuOQami_vJaEGhoLhb3Upt_Ju7WwLXQ9ktcpis6qe2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "None" "Standard%20VGA%20Graphics%20Adapter" "Toncoin" "ton"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAP2qRJuOQami_vJaEGhoLhb3Upt_Ju7WwLXQ9ktcpis6qe4⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "None" "Standard%20VGA%20Graphics%20Adapter" "Toncoin" "ton"4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAP2qRJuOQami_vJaEGhoLhb3Upt_Ju7WwLXQ9ktcpis6qe6⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "None" "Standard%20VGA%20Graphics%20Adapter" "Toncoin" "ton"6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
7e80c2ae5587b824d8230e782089e86b
SHA190f0912a29b9cc7a55bd4b561e1a574e005cecf6
SHA25643d66e78f5334cc183e22aa29c64a9fdf4356e5a0c5052489fd7edc127460a6c
SHA512db0e42e94976b9fe4d75a502b0a32f3ec4e6b993de02781ccef11a4aebc0fb0cedf1d43cd2280faa186edb66ff869f2b883f091889958625081b1a97cde5203a
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
7e80c2ae5587b824d8230e782089e86b
SHA190f0912a29b9cc7a55bd4b561e1a574e005cecf6
SHA25643d66e78f5334cc183e22aa29c64a9fdf4356e5a0c5052489fd7edc127460a6c
SHA512db0e42e94976b9fe4d75a502b0a32f3ec4e6b993de02781ccef11a4aebc0fb0cedf1d43cd2280faa186edb66ff869f2b883f091889958625081b1a97cde5203a
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
7e80c2ae5587b824d8230e782089e86b
SHA190f0912a29b9cc7a55bd4b561e1a574e005cecf6
SHA25643d66e78f5334cc183e22aa29c64a9fdf4356e5a0c5052489fd7edc127460a6c
SHA512db0e42e94976b9fe4d75a502b0a32f3ec4e6b993de02781ccef11a4aebc0fb0cedf1d43cd2280faa186edb66ff869f2b883f091889958625081b1a97cde5203a
-
\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
7e80c2ae5587b824d8230e782089e86b
SHA190f0912a29b9cc7a55bd4b561e1a574e005cecf6
SHA25643d66e78f5334cc183e22aa29c64a9fdf4356e5a0c5052489fd7edc127460a6c
SHA512db0e42e94976b9fe4d75a502b0a32f3ec4e6b993de02781ccef11a4aebc0fb0cedf1d43cd2280faa186edb66ff869f2b883f091889958625081b1a97cde5203a
-
\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
7e80c2ae5587b824d8230e782089e86b
SHA190f0912a29b9cc7a55bd4b561e1a574e005cecf6
SHA25643d66e78f5334cc183e22aa29c64a9fdf4356e5a0c5052489fd7edc127460a6c
SHA512db0e42e94976b9fe4d75a502b0a32f3ec4e6b993de02781ccef11a4aebc0fb0cedf1d43cd2280faa186edb66ff869f2b883f091889958625081b1a97cde5203a
-
\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
7e80c2ae5587b824d8230e782089e86b
SHA190f0912a29b9cc7a55bd4b561e1a574e005cecf6
SHA25643d66e78f5334cc183e22aa29c64a9fdf4356e5a0c5052489fd7edc127460a6c
SHA512db0e42e94976b9fe4d75a502b0a32f3ec4e6b993de02781ccef11a4aebc0fb0cedf1d43cd2280faa186edb66ff869f2b883f091889958625081b1a97cde5203a
-
memory/524-58-0x0000000140000000-0x000000014274C000-memory.dmpFilesize
39.3MB
-
memory/524-61-0x0000000140000000-0x000000014274C000-memory.dmpFilesize
39.3MB
-
memory/524-60-0x0000000140000000-0x000000014274C000-memory.dmpFilesize
39.3MB
-
memory/524-59-0x0000000140000000-0x000000014274C000-memory.dmpFilesize
39.3MB
-
memory/676-97-0x000000013F6E0000-0x0000000140029000-memory.dmpFilesize
9.3MB
-
memory/676-98-0x000000013F6E0000-0x0000000140029000-memory.dmpFilesize
9.3MB
-
memory/676-99-0x000000013F6E0000-0x0000000140029000-memory.dmpFilesize
9.3MB
-
memory/972-69-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/972-65-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/972-68-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/972-71-0x000007FEFC151000-0x000007FEFC153000-memory.dmpFilesize
8KB
-
memory/972-70-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/972-62-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/972-63-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/972-64-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/972-76-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/972-67-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/972-66-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/1492-93-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/1928-55-0x000000013FD10000-0x0000000140659000-memory.dmpFilesize
9.3MB
-
memory/1928-57-0x000000013FD10000-0x0000000140659000-memory.dmpFilesize
9.3MB
-
memory/1928-56-0x000000013FD10000-0x0000000140659000-memory.dmpFilesize
9.3MB
-
memory/1992-79-0x000000013F1B0000-0x000000013FAF9000-memory.dmpFilesize
9.3MB
-
memory/1992-78-0x000000013F1B0000-0x000000013FAF9000-memory.dmpFilesize
9.3MB
-
memory/1992-77-0x000000013F1B0000-0x000000013FAF9000-memory.dmpFilesize
9.3MB