Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:54
Static task
static1
Behavioral task
behavioral1
Sample
BJEBEL9UBFA2EIDN5GRFS5C09QO1YYW0K19TF9E.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
BJEBEL9UBFA2EIDN5GRFS5C09QO1YYW0K19TF9E.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
H1ZGRUEJUYOGBIJ307WC4YFDIMZL7OG83UHX.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
H1ZGRUEJUYOGBIJ307WC4YFDIMZL7OG83UHX.exe
Resource
win10v2004-20220414-en
General
-
Target
BJEBEL9UBFA2EIDN5GRFS5C09QO1YYW0K19TF9E.dll
-
Size
8.5MB
-
MD5
43f089b7855dfe47e1dfe348445b5865
-
SHA1
8b20f11e27be02a8bda40ca9f48603e7adfd76de
-
SHA256
33ffacc3e517f4f1dad47f1ca28d26188e202d5e2e300e1e71bc0a57e682292a
-
SHA512
8a7f7a2dc536849f9452317ace271c398a623be305d74c4c0ea4acbdcb9a314a407d5075fadb41637ef751b1cee517e1df11c9d9f180fd016337f54103fa5fd8
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/1656-56-0x00000000023D0000-0x000000000361E000-memory.dmp themida behavioral1/memory/1656-57-0x00000000023D0000-0x000000000361E000-memory.dmp themida behavioral1/memory/1656-58-0x00000000023D0000-0x000000000361E000-memory.dmp themida behavioral1/memory/1656-60-0x00000000023D0000-0x000000000361E000-memory.dmp themida behavioral1/memory/1656-61-0x00000000023D0000-0x000000000361E000-memory.dmp themida behavioral1/memory/1656-62-0x00000000023D0000-0x000000000361E000-memory.dmp themida behavioral1/memory/1656-63-0x00000000023D0000-0x000000000361E000-memory.dmp themida behavioral1/memory/1656-64-0x00000000023D0000-0x000000000361E000-memory.dmp themida -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 1656 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1232 1656 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1260 wrote to memory of 1656 1260 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1656 1260 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1656 1260 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1656 1260 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1656 1260 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1656 1260 rundll32.exe rundll32.exe PID 1260 wrote to memory of 1656 1260 rundll32.exe rundll32.exe PID 1656 wrote to memory of 1232 1656 rundll32.exe WerFault.exe PID 1656 wrote to memory of 1232 1656 rundll32.exe WerFault.exe PID 1656 wrote to memory of 1232 1656 rundll32.exe WerFault.exe PID 1656 wrote to memory of 1232 1656 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\BJEBEL9UBFA2EIDN5GRFS5C09QO1YYW0K19TF9E.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\BJEBEL9UBFA2EIDN5GRFS5C09QO1YYW0K19TF9E.dll,#12⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 6043⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1232-65-0x0000000000000000-mapping.dmp
-
memory/1656-54-0x0000000000000000-mapping.dmp
-
memory/1656-55-0x0000000075361000-0x0000000075363000-memory.dmpFilesize
8KB
-
memory/1656-56-0x00000000023D0000-0x000000000361E000-memory.dmpFilesize
18.3MB
-
memory/1656-57-0x00000000023D0000-0x000000000361E000-memory.dmpFilesize
18.3MB
-
memory/1656-58-0x00000000023D0000-0x000000000361E000-memory.dmpFilesize
18.3MB
-
memory/1656-59-0x0000000077300000-0x0000000077480000-memory.dmpFilesize
1.5MB
-
memory/1656-60-0x00000000023D0000-0x000000000361E000-memory.dmpFilesize
18.3MB
-
memory/1656-61-0x00000000023D0000-0x000000000361E000-memory.dmpFilesize
18.3MB
-
memory/1656-62-0x00000000023D0000-0x000000000361E000-memory.dmpFilesize
18.3MB
-
memory/1656-63-0x00000000023D0000-0x000000000361E000-memory.dmpFilesize
18.3MB
-
memory/1656-64-0x00000000023D0000-0x000000000361E000-memory.dmpFilesize
18.3MB