Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30-01-2022 17:08
Static task
static1
Behavioral task
behavioral1
Sample
19939221b42945f254c280e7029b02a397e9e3d78e200293bf3c8f2ec4400a5c.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
19939221b42945f254c280e7029b02a397e9e3d78e200293bf3c8f2ec4400a5c.dll
-
Size
3.0MB
-
MD5
2934a7a0dfaf2ebc81b1f089277129c4
-
SHA1
4378996bbb7be3a805d77899a98ff7ac62933c0e
-
SHA256
19939221b42945f254c280e7029b02a397e9e3d78e200293bf3c8f2ec4400a5c
-
SHA512
98f7e56e6a7408ee96020e0fd529b51aef742caaa9a422a5d731b351f88cbc6b5a5de04eb1c38fc12801a83dcc17b320a5e9e7aa35e77708de02fb9ba68e13d1
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/1396-54-0x000007FEF52F0000-0x000007FEF5A67000-memory.dmp themida behavioral1/memory/1396-55-0x000007FEF52F0000-0x000007FEF5A67000-memory.dmp themida behavioral1/memory/1396-56-0x000007FEF52F0000-0x000007FEF5A67000-memory.dmp themida -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 1396 rundll32.exe