Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
29/05/2022, 16:06
Static task
static1
Behavioral task
behavioral1
Sample
0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe
Resource
win10v2004-20220414-en
General
-
Target
0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe
-
Size
1.9MB
-
MD5
73461127ecd53340878c5c8dd558cacb
-
SHA1
4efb8f4f888fed27a1866118739fb4b3e7dcbd0e
-
SHA256
0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f
-
SHA512
2a7eb7a92bda07637631356faf6d9357cf3393c119cf663f3c9d31ec8c64c53e67801bd0c26004a973346e98a47a4f75e711899cf1c1b142a50df00306b9d390
Malware Config
Extracted
buer
http://loood1.top/
http://loood2.top/
Signatures
-
resource yara_rule behavioral1/memory/1256-62-0x000000003F050000-0x000000003F50B000-memory.dmp buer behavioral1/memory/1280-72-0x000000003FB90000-0x000000004004B000-memory.dmp buer behavioral1/memory/1280-82-0x000000003FB90000-0x000000004004B000-memory.dmp buer behavioral1/memory/1280-83-0x000000003FB90000-0x000000004004B000-memory.dmp buer -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ manager.exe -
Executes dropped EXE 1 IoCs
pid Process 1280 manager.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion manager.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion manager.exe -
Deletes itself 1 IoCs
pid Process 1280 manager.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Wine 0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Wine manager.exe -
Loads dropped DLL 2 IoCs
pid Process 1256 0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe 1256 0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce manager.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ActiveX Component = "C:\\Users\\Admin\\AppData\\Roaming\\ActiveX\\manager.exe" manager.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1256 0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe 1280 manager.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1256 0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe 1280 manager.exe 1280 manager.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1256 wrote to memory of 1280 1256 0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe 27 PID 1256 wrote to memory of 1280 1256 0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe 27 PID 1256 wrote to memory of 1280 1256 0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe 27 PID 1256 wrote to memory of 1280 1256 0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe 27 PID 1280 wrote to memory of 1116 1280 manager.exe 28 PID 1280 wrote to memory of 1116 1280 manager.exe 28 PID 1280 wrote to memory of 1116 1280 manager.exe 28 PID 1280 wrote to memory of 1116 1280 manager.exe 28 PID 1280 wrote to memory of 1116 1280 manager.exe 28 PID 1280 wrote to memory of 1116 1280 manager.exe 28 PID 1280 wrote to memory of 1116 1280 manager.exe 28 PID 1280 wrote to memory of 1116 1280 manager.exe 28 PID 1280 wrote to memory of 1116 1280 manager.exe 28 PID 1280 wrote to memory of 1116 1280 manager.exe 28 PID 1280 wrote to memory of 1116 1280 manager.exe 28 PID 1280 wrote to memory of 1116 1280 manager.exe 28 PID 1280 wrote to memory of 1116 1280 manager.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe"C:\Users\Admin\AppData\Local\Temp\0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Roaming\ActiveX\manager.exeC:\Users\Admin\AppData\Roaming\ActiveX\manager.exe "C:\Users\Admin\AppData\Local\Temp\0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe" ensgJJ2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Deletes itself
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\secinit.exeC:\Users\Admin\AppData\Roaming\ActiveX\manager.exe3⤵PID:1116
-
-