Analysis
-
max time kernel
138s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18/06/2022, 03:40
General
-
Target
setup/AISetup.exe
-
Size
465.0MB
-
MD5
e729c14e3ba0a6eff92196a8047c3a08
-
SHA1
5c27015b56dcc63b058518a5bf9d7535354ebe9b
-
SHA256
07cc8639fd86e1d80e664ff18a2f45f163b736f0bd28a2b166a00c0733d656dd
-
SHA512
45a00dc294626e68a9f2ca0a183a2c24e2aaa778eadd5d2a76ba2814d6886f73196a605e2e23fce3d5efb701da1c9af967560a8a3d01556d4ea2ad2b6540b53d
Malware Config
Extracted
recordbreaker
http://146.19.247.52/
http://77.91.102.115/
Signatures
-
RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
-
suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
-
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup\AISetup.exe"C:\Users\Admin\AppData\Local\Temp\setup\AISetup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
7.6MB
-
Filesize
7.6MB
-
Filesize
7.6MB
-
Filesize
1.5MB
-
Filesize
7.6MB
-
Filesize
1.5MB