Overview

overview

9

Static

static

7d40339fca...15.dll

windows7_x64

9

7d40339fca...15.dll

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7d40339fca72718ec77ca4cad6d611f13cae059a53c0870446761a80dff1f115

  • Size

    2.4MB

  • Sample

    220520-18va8aehb9

  • MD5

    b89dd8b599e9fac14ea46b60c54554f9

  • SHA1

    bcfea8f8611850b79389f1f5014e2c219cfd44b4

  • SHA256

    7d40339fca72718ec77ca4cad6d611f13cae059a53c0870446761a80dff1f115

  • SHA512

    721c8551807125d9094beeff7c62973e65fd8595732c9d927334e9c89e4a2e80fcdf00c76969dcf95bf1627f8a00ea3a1f0483c8792e5e25ac70e8cbf385a233

Score
9/10
evasion

Malware Config

Targets

    • Target

      7d40339fca72718ec77ca4cad6d611f13cae059a53c0870446761a80dff1f115

    • Size

      2.4MB

    • MD5

      b89dd8b599e9fac14ea46b60c54554f9

    • SHA1

      bcfea8f8611850b79389f1f5014e2c219cfd44b4

    • SHA256

      7d40339fca72718ec77ca4cad6d611f13cae059a53c0870446761a80dff1f115

    • SHA512

      721c8551807125d9094beeff7c62973e65fd8595732c9d927334e9c89e4a2e80fcdf00c76969dcf95bf1627f8a00ea3a1f0483c8792e5e25ac70e8cbf385a233

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks