Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30-01-2022 16:59
Static task
static1
Behavioral task
behavioral1
Sample
de90e611bc3f46a6a7aab948800a2558003bc850d69ebbda672379845e79cbe9.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
de90e611bc3f46a6a7aab948800a2558003bc850d69ebbda672379845e79cbe9.dll
-
Size
3.6MB
-
MD5
97e5c0fe8089da97665a22975e2c86de
-
SHA1
d5fa9362e37b31c61a778c0d05c3c3a784ec2118
-
SHA256
de90e611bc3f46a6a7aab948800a2558003bc850d69ebbda672379845e79cbe9
-
SHA512
9de1164c48acd11cbaf56c1a5d2f81efee1eb18fa6f0cea9e9a7fd2c9b61b055aa3c8347712ba1d30b3cbe9bdf20b98fb9dc55773e4c70219ac93799c42e4af1
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/948-55-0x000007FEF4BD0000-0x000007FEF553F000-memory.dmp themida behavioral1/memory/948-56-0x000007FEF4BD0000-0x000007FEF553F000-memory.dmp themida behavioral1/memory/948-57-0x000007FEF4BD0000-0x000007FEF553F000-memory.dmp themida behavioral1/memory/948-58-0x000007FEF4BD0000-0x000007FEF553F000-memory.dmp themida -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 948 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-55-0x000007FEF4BD0000-0x000007FEF553F000-memory.dmpFilesize
9.4MB
-
memory/948-56-0x000007FEF4BD0000-0x000007FEF553F000-memory.dmpFilesize
9.4MB
-
memory/948-57-0x000007FEF4BD0000-0x000007FEF553F000-memory.dmpFilesize
9.4MB
-
memory/948-58-0x000007FEF4BD0000-0x000007FEF553F000-memory.dmpFilesize
9.4MB