Analysis

  • max time kernel
    41s
  • max time network
    44s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    22-06-2022 17:51

General

  • Target

    zbyrtzciif.dll

  • Size

    7.0MB

  • MD5

    e542f38011cc165154b3178db74032cb

  • SHA1

    e09fc2c03003e84790be3a17b97fa2e90f08e2e9

  • SHA256

    5019200109e04421b1097f6426450551e215c1b83f759a79fb4373e33d3d1002

  • SHA512

    4911dc7e2233a1b2033801b222e674cf0c22915bdc1445059c12f52281df81c67b2f7009e3c8f048ca9131dbf608595467c5e20095844e66d985356410eb7ccf

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\zbyrtzciif.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\zbyrtzciif.dll,#1
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3136
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 756
        3⤵
        • Program crash
        PID:4240
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3136 -ip 3136
    1⤵
      PID:2000

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Virtualization/Sandbox Evasion

    1
    T1497

    Discovery

    Query Registry

    2
    T1012

    Virtualization/Sandbox Evasion

    1
    T1497

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3136-130-0x0000000000000000-mapping.dmp
    • memory/3136-131-0x00000000023C0000-0x0000000003513000-memory.dmp
      Filesize

      17.3MB

    • memory/3136-132-0x00000000023C0000-0x0000000003513000-memory.dmp
      Filesize

      17.3MB

    • memory/3136-133-0x0000000077620000-0x00000000777C3000-memory.dmp
      Filesize

      1.6MB

    • memory/3136-134-0x00000000023C0000-0x0000000003513000-memory.dmp
      Filesize

      17.3MB

    • memory/3136-135-0x00000000023C0000-0x0000000003513000-memory.dmp
      Filesize

      17.3MB

    • memory/3136-136-0x00000000023C0000-0x0000000003513000-memory.dmp
      Filesize

      17.3MB

    • memory/3136-137-0x00000000023C0000-0x0000000003513000-memory.dmp
      Filesize

      17.3MB

    • memory/3136-138-0x00000000023C0000-0x0000000003513000-memory.dmp
      Filesize

      17.3MB

    • memory/3136-139-0x00000000023C0000-0x0000000003513000-memory.dmp
      Filesize

      17.3MB

    • memory/3136-140-0x0000000077620000-0x00000000777C3000-memory.dmp
      Filesize

      1.6MB