Analysis
-
max time kernel
65s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 20:35
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220721-en
General
-
Target
file.exe
-
Size
4.6MB
-
MD5
e67b0f88dec67711f626ca630d1ddfa9
-
SHA1
be17d231d4e92f7bd01dbe2dc49d423cfce7a191
-
SHA256
c40b255d65ff06e10b6d8ee03ca5cd1bd3e80cb5e88b84107fa450e7931b1e40
-
SHA512
c3f66d2f24f28e459fa05f4487115312f780cb567f71294e20fd911592e8ec645d457b8b46fa07f18a4ebb7945103ec4a8dd10ea763b4636088339c54dc1a41a
Malware Config
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe -
Processes:
resource yara_rule behavioral2/memory/1552-130-0x0000000001000000-0x00000000019BA000-memory.dmp themida behavioral2/memory/1552-131-0x0000000001000000-0x00000000019BA000-memory.dmp themida behavioral2/memory/1552-136-0x0000000001000000-0x00000000019BA000-memory.dmp themida behavioral2/memory/1552-137-0x0000000001000000-0x00000000019BA000-memory.dmp themida behavioral2/memory/1552-138-0x0000000001000000-0x00000000019BA000-memory.dmp themida behavioral2/memory/1552-140-0x0000000001000000-0x00000000019BA000-memory.dmp themida behavioral2/memory/1552-141-0x0000000001000000-0x00000000019BA000-memory.dmp themida behavioral2/memory/1552-143-0x0000000001000000-0x00000000019BA000-memory.dmp themida -
Processes:
file.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
file.exepid process 1552 file.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
file.exepid process 1552 file.exe 1552 file.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1552
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1552-130-0x0000000001000000-0x00000000019BA000-memory.dmpFilesize
9.7MB
-
memory/1552-131-0x0000000001000000-0x00000000019BA000-memory.dmpFilesize
9.7MB
-
memory/1552-136-0x0000000001000000-0x00000000019BA000-memory.dmpFilesize
9.7MB
-
memory/1552-137-0x0000000001000000-0x00000000019BA000-memory.dmpFilesize
9.7MB
-
memory/1552-138-0x0000000001000000-0x00000000019BA000-memory.dmpFilesize
9.7MB
-
memory/1552-139-0x00000000778A0000-0x0000000077A43000-memory.dmpFilesize
1.6MB
-
memory/1552-140-0x0000000001000000-0x00000000019BA000-memory.dmpFilesize
9.7MB
-
memory/1552-141-0x0000000001000000-0x00000000019BA000-memory.dmpFilesize
9.7MB
-
memory/1552-142-0x00000000778A0000-0x0000000077A43000-memory.dmpFilesize
1.6MB
-
memory/1552-143-0x0000000001000000-0x00000000019BA000-memory.dmpFilesize
9.7MB
-
memory/1552-144-0x00000000778A0000-0x0000000077A43000-memory.dmpFilesize
1.6MB