Analysis
-
max time kernel
41s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
22-06-2022 17:51
Static task
static1
Behavioral task
behavioral1
Sample
4589.zip
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4589.zip
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
kdrkdk41du1eb4ap8iwo2rb59ggg.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
kdrkdk41du1eb4ap8iwo2rb59ggg.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
zbyrtzciif.dll
Resource
win7-20220414-en
General
-
Target
zbyrtzciif.dll
-
Size
7.0MB
-
MD5
e542f38011cc165154b3178db74032cb
-
SHA1
e09fc2c03003e84790be3a17b97fa2e90f08e2e9
-
SHA256
5019200109e04421b1097f6426450551e215c1b83f759a79fb4373e33d3d1002
-
SHA512
4911dc7e2233a1b2033801b222e674cf0c22915bdc1445059c12f52281df81c67b2f7009e3c8f048ca9131dbf608595467c5e20095844e66d985356410eb7ccf
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Processes:
resource yara_rule behavioral6/memory/3136-131-0x00000000023C0000-0x0000000003513000-memory.dmp themida behavioral6/memory/3136-132-0x00000000023C0000-0x0000000003513000-memory.dmp themida behavioral6/memory/3136-134-0x00000000023C0000-0x0000000003513000-memory.dmp themida behavioral6/memory/3136-135-0x00000000023C0000-0x0000000003513000-memory.dmp themida behavioral6/memory/3136-136-0x00000000023C0000-0x0000000003513000-memory.dmp themida behavioral6/memory/3136-137-0x00000000023C0000-0x0000000003513000-memory.dmp themida behavioral6/memory/3136-138-0x00000000023C0000-0x0000000003513000-memory.dmp themida behavioral6/memory/3136-139-0x00000000023C0000-0x0000000003513000-memory.dmp themida -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 3136 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4240 3136 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4792 wrote to memory of 3136 4792 rundll32.exe rundll32.exe PID 4792 wrote to memory of 3136 4792 rundll32.exe rundll32.exe PID 4792 wrote to memory of 3136 4792 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\zbyrtzciif.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\zbyrtzciif.dll,#12⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 7563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3136 -ip 31361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3136-130-0x0000000000000000-mapping.dmp
-
memory/3136-131-0x00000000023C0000-0x0000000003513000-memory.dmpFilesize
17.3MB
-
memory/3136-132-0x00000000023C0000-0x0000000003513000-memory.dmpFilesize
17.3MB
-
memory/3136-133-0x0000000077620000-0x00000000777C3000-memory.dmpFilesize
1.6MB
-
memory/3136-134-0x00000000023C0000-0x0000000003513000-memory.dmpFilesize
17.3MB
-
memory/3136-135-0x00000000023C0000-0x0000000003513000-memory.dmpFilesize
17.3MB
-
memory/3136-136-0x00000000023C0000-0x0000000003513000-memory.dmpFilesize
17.3MB
-
memory/3136-137-0x00000000023C0000-0x0000000003513000-memory.dmpFilesize
17.3MB
-
memory/3136-138-0x00000000023C0000-0x0000000003513000-memory.dmpFilesize
17.3MB
-
memory/3136-139-0x00000000023C0000-0x0000000003513000-memory.dmpFilesize
17.3MB
-
memory/3136-140-0x0000000077620000-0x00000000777C3000-memory.dmpFilesize
1.6MB