Analysis

  • max time kernel
    45s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    22-06-2022 17:51

General

  • Target

    zbyrtzciif.dll

  • Size

    7.0MB

  • MD5

    e542f38011cc165154b3178db74032cb

  • SHA1

    e09fc2c03003e84790be3a17b97fa2e90f08e2e9

  • SHA256

    5019200109e04421b1097f6426450551e215c1b83f759a79fb4373e33d3d1002

  • SHA512

    4911dc7e2233a1b2033801b222e674cf0c22915bdc1445059c12f52281df81c67b2f7009e3c8f048ca9131dbf608595467c5e20095844e66d985356410eb7ccf

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\zbyrtzciif.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\zbyrtzciif.dll,#1
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 316
        3⤵
        • Program crash
        PID:1240

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1044-54-0x0000000000000000-mapping.dmp
  • memory/1044-55-0x00000000763C1000-0x00000000763C3000-memory.dmp
    Filesize

    8KB

  • memory/1044-57-0x0000000077690000-0x0000000077810000-memory.dmp
    Filesize

    1.5MB

  • memory/1044-56-0x0000000002400000-0x0000000003553000-memory.dmp
    Filesize

    17.3MB

  • memory/1044-58-0x0000000002400000-0x0000000003553000-memory.dmp
    Filesize

    17.3MB

  • memory/1044-59-0x0000000002400000-0x0000000003553000-memory.dmp
    Filesize

    17.3MB

  • memory/1044-60-0x0000000002400000-0x0000000003553000-memory.dmp
    Filesize

    17.3MB

  • memory/1044-61-0x0000000002400000-0x0000000003553000-memory.dmp
    Filesize

    17.3MB

  • memory/1044-62-0x0000000002400000-0x0000000003553000-memory.dmp
    Filesize

    17.3MB

  • memory/1044-63-0x0000000002400000-0x0000000003553000-memory.dmp
    Filesize

    17.3MB

  • memory/1044-64-0x0000000002400000-0x0000000003553000-memory.dmp
    Filesize

    17.3MB

  • memory/1240-65-0x0000000000000000-mapping.dmp