Analysis
-
max time kernel
125s -
max time network
144s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-01-2022 16:59
Static task
static1
Behavioral task
behavioral1
Sample
de90e611bc3f46a6a7aab948800a2558003bc850d69ebbda672379845e79cbe9.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
de90e611bc3f46a6a7aab948800a2558003bc850d69ebbda672379845e79cbe9.dll
-
Size
3.6MB
-
MD5
97e5c0fe8089da97665a22975e2c86de
-
SHA1
d5fa9362e37b31c61a778c0d05c3c3a784ec2118
-
SHA256
de90e611bc3f46a6a7aab948800a2558003bc850d69ebbda672379845e79cbe9
-
SHA512
9de1164c48acd11cbaf56c1a5d2f81efee1eb18fa6f0cea9e9a7fd2c9b61b055aa3c8347712ba1d30b3cbe9bdf20b98fb9dc55773e4c70219ac93799c42e4af1
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Processes:
resource yara_rule behavioral2/memory/3712-117-0x00007FFE94BF0000-0x00007FFE9555F000-memory.dmp themida behavioral2/memory/3712-118-0x00007FFE94BF0000-0x00007FFE9555F000-memory.dmp themida behavioral2/memory/3712-119-0x00007FFE94BF0000-0x00007FFE9555F000-memory.dmp themida behavioral2/memory/3712-120-0x00007FFE94BF0000-0x00007FFE9555F000-memory.dmp themida -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 3712 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3712-117-0x00007FFE94BF0000-0x00007FFE9555F000-memory.dmpFilesize
9.4MB
-
memory/3712-118-0x00007FFE94BF0000-0x00007FFE9555F000-memory.dmpFilesize
9.4MB
-
memory/3712-119-0x00007FFE94BF0000-0x00007FFE9555F000-memory.dmpFilesize
9.4MB
-
memory/3712-120-0x00007FFE94BF0000-0x00007FFE9555F000-memory.dmpFilesize
9.4MB