Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 10:29
General
-
Target
410eac5d77ea5b38a45a44079cba89f1f3fa6234ff16dd63dbde3476ce364b36.exe
-
Size
8.9MB
-
MD5
46168b6bae327a9d6aa590fbd5a9688a
-
SHA1
b14ef01b29545966e801c3f8b55fb733fbf5f63b
-
SHA256
410eac5d77ea5b38a45a44079cba89f1f3fa6234ff16dd63dbde3476ce364b36
-
SHA512
12f375f2259161e0eb1c8b79dedac7369b428ca2d7fb610e8a839db490c5640ceb98751b248d506607895174a8a9a82ecb0656a703ad82c7c6f3610a3cfa28f8
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\410eac5d77ea5b38a45a44079cba89f1f3fa6234ff16dd63dbde3476ce364b36.exe"C:\Users\Admin\AppData\Local\Temp\410eac5d77ea5b38a45a44079cba89f1f3fa6234ff16dd63dbde3476ce364b36.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\³ÌÅÕ²µËËÇʶ¶¸»¸´ÕØ×À¹ÈÏËòÚÓÓÈƸÍÙ¶²µÖÀ¶Ð´·ËÅϵ̺¶Ô³Í°ÔʿƶչÍÆϾ»ÙÖËØÊ°¹À¶ÒÖÏËÙÏžÎü¿»ÎÈÁµÙ×ϽÄÁÁ.exeC:\Users\Admin\AppData\Local\Temp\³ÌÅÕ²µËËÇʶ¶¸»¸´ÕØ×À¹ÈÏËòÚÓÓÈƸÍÙ¶²µÖÀ¶Ð´·ËÅϵ̺¶Ô³Í°ÔʿƶչÍÆϾ»ÙÖËØÊ°¹À¶ÒÖÏËÙÏžÎü¿»ÎÈÁµÙ×ϽÄÁÁ.exe2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD544e8915f98d9dc12825a6c3fba79eebc
SHA14d34fd5f816e9e332602071da2b9854d7ffd5aec
SHA256906c93a5bb1e49a283b7942c3f78a2b379701a9f78346626f445f9021ca5e6e6
SHA5124596cb8dd8d63cc4ea2e575e1d2ebb7c9a270fa80997fac743ed324a248c99795e79b6b5a5db28305417312e162f74da351610827c1b0a6dd6ea0b3099cf4097
-
Filesize
8.2MB
MD544e8915f98d9dc12825a6c3fba79eebc
SHA14d34fd5f816e9e332602071da2b9854d7ffd5aec
SHA256906c93a5bb1e49a283b7942c3f78a2b379701a9f78346626f445f9021ca5e6e6
SHA5124596cb8dd8d63cc4ea2e575e1d2ebb7c9a270fa80997fac743ed324a248c99795e79b6b5a5db28305417312e162f74da351610827c1b0a6dd6ea0b3099cf4097
-
-
Filesize
17.8MB