Analysis
-
max time kernel
117s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
02-03-2022 17:06
General
-
Target
47d8679cef92d54658d18b82d662a266.exe
-
Size
6.3MB
-
MD5
47d8679cef92d54658d18b82d662a266
-
SHA1
90abb5e5648457b1fdace92f3749c31473193e55
-
SHA256
97b6f1724f915772098ffcbb2350bef100dd2c3d7cd26be39e9a3ca095d7ea62
-
SHA512
05cb6ffaedfe0713545a0d27d1c27f6031d483698bfa14cc5037f918814500643ae461a3dfe003e5dab6aff5b979e8164157c20a2e526eb681aeed699915ab87
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\47d8679cef92d54658d18b82d662a266.exe"C:\Users\Admin\AppData\Local\Temp\47d8679cef92d54658d18b82d662a266.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/372-130-0x00007FFA80000000-0x00007FFA80002000-memory.dmpFilesize
8KB
-
memory/372-131-0x00007FFACF17B000-0x00007FFACF17C000-memory.dmpFilesize
4KB
-
memory/372-132-0x00007FFACE814000-0x00007FFACE815000-memory.dmpFilesize
4KB
-
memory/372-133-0x00007FF64EFE0000-0x00007FF64F63C000-memory.dmpFilesize
6.4MB
-
memory/372-134-0x00007FF64EFE0000-0x00007FF64F63C000-memory.dmpFilesize
6.4MB
-
memory/372-135-0x00007FFA80030000-0x00007FFA80031000-memory.dmpFilesize
4KB
-
memory/372-136-0x00007FFAB04E3000-0x00007FFAB04E5000-memory.dmpFilesize
8KB
-
memory/372-137-0x0000000002F70000-0x0000000002F72000-memory.dmpFilesize
8KB
-
memory/372-138-0x000000001F950000-0x000000001FA5A000-memory.dmpFilesize
1.0MB
-
memory/372-139-0x0000000002F20000-0x0000000002F32000-memory.dmpFilesize
72KB
-
memory/372-140-0x00000000030F0000-0x000000000312C000-memory.dmpFilesize
240KB
-
memory/372-141-0x000000001F8C0000-0x000000001F936000-memory.dmpFilesize
472KB
-
memory/372-142-0x0000000002F80000-0x0000000002F9E000-memory.dmpFilesize
120KB
-
memory/372-143-0x0000000020D60000-0x0000000020F22000-memory.dmpFilesize
1.8MB
-
memory/372-144-0x0000000021660000-0x0000000021B88000-memory.dmpFilesize
5.2MB
-
memory/372-145-0x000000001FB00000-0x000000001FB50000-memory.dmpFilesize
320KB
-
memory/372-146-0x0000000002F72000-0x0000000002F74000-memory.dmpFilesize
8KB