6254f13144bdddb0931ad447830f9af5281cbb8f6b77c2a1357940762dbc4cc9

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
27-07-2022 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50DA248332E17121AF01CD7929069B7F.exe
Size

7.1MB
MD5

50da248332e17121af01cd7929069b7f
SHA1

0fe37d82a25b11f189fae1469352851a0e6f2a87
SHA256

6254f13144bdddb0931ad447830f9af5281cbb8f6b77c2a1357940762dbc4cc9
SHA512

af35df32c61cd0b3dfdd9ab378fbd12e3e57f28fd6759e7aaaec8f8409a30a66c963a386311b4dea47f050816008acb33f71fbcca275039523a7b938841e0812

Score

9^/10

discovery evasion spyware stealer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

risker.exeDpEditor.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	risker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DpEditor.exe

Executes dropped EXE 2 IoCs

Processes:

risker.exeDpEditor.exe

pid process

472 risker.exe
612 DpEditor.exe

pid	process
472	risker.exe
612	DpEditor.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

risker.exeDpEditor.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	risker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	risker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DpEditor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DpEditor.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

840 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exerisker.exe

pid process

1972 cmd.exe
472 risker.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
840	cmd.exe

pid	process
1972	cmd.exe
472	risker.exe

Themida packer 17 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\C97D5738C9582AEF\risker.exe	themida
C:\Users\Admin\AppData\Roaming\C97D5738C9582AEF\risker.exe	themida
\Users\Admin\AppData\Roaming\C97D5738C9582AEF\risker.exe	themida
behavioral1/memory/472-65-0x0000000000B20000-0x0000000001200000-memory.dmp	themida
behavioral1/memory/472-66-0x0000000000B20000-0x0000000001200000-memory.dmp	themida
behavioral1/memory/472-67-0x0000000000B20000-0x0000000001200000-memory.dmp	themida
behavioral1/memory/472-68-0x0000000000B20000-0x0000000001200000-memory.dmp	themida
behavioral1/memory/472-70-0x0000000000B20000-0x0000000001200000-memory.dmp	themida
\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe	themida
behavioral1/memory/472-79-0x0000000000B20000-0x0000000001200000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe	themida
behavioral1/memory/612-81-0x00000000011D0000-0x00000000018B0000-memory.dmp	themida
behavioral1/memory/612-82-0x00000000011D0000-0x00000000018B0000-memory.dmp	themida
behavioral1/memory/612-83-0x00000000011D0000-0x00000000018B0000-memory.dmp	themida
behavioral1/memory/612-84-0x00000000011D0000-0x00000000018B0000-memory.dmp	themida
behavioral1/memory/612-85-0x00000000011D0000-0x00000000018B0000-memory.dmp	themida
behavioral1/memory/612-87-0x00000000011D0000-0x00000000018B0000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

risker.exeDpEditor.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	risker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DpEditor.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

50DA248332E17121AF01CD7929069B7F.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	50DA248332E17121AF01CD7929069B7F.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\ProductId	50DA248332E17121AF01CD7929069B7F.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

50DA248332E17121AF01CD7929069B7F.exerisker.exeDpEditor.exe

pid process

1052 50DA248332E17121AF01CD7929069B7F.exe
1052 50DA248332E17121AF01CD7929069B7F.exe
472 risker.exe
612 DpEditor.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1052	50DA248332E17121AF01CD7929069B7F.exe
1052	50DA248332E17121AF01CD7929069B7F.exe
472	risker.exe
612	DpEditor.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

50DA248332E17121AF01CD7929069B7F.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	50DA248332E17121AF01CD7929069B7F.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	50DA248332E17121AF01CD7929069B7F.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	50DA248332E17121AF01CD7929069B7F.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1392 timeout.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

DpEditor.exe

pid process

612 DpEditor.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

50DA248332E17121AF01CD7929069B7F.exerisker.exeDpEditor.exe

pid process

1052 50DA248332E17121AF01CD7929069B7F.exe
1052 50DA248332E17121AF01CD7929069B7F.exe
472 risker.exe
612 DpEditor.exe

pid	process
1392	timeout.exe

pid	process
612	DpEditor.exe

pid	process
1052	50DA248332E17121AF01CD7929069B7F.exe
1052	50DA248332E17121AF01CD7929069B7F.exe
472	risker.exe
612	DpEditor.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

50DA248332E17121AF01CD7929069B7F.execmd.execmd.exerisker.exe

description	pid	process	target process
PID 1052 wrote to memory of 1972	1052	50DA248332E17121AF01CD7929069B7F.exe	cmd.exe
PID 1052 wrote to memory of 1972	1052	50DA248332E17121AF01CD7929069B7F.exe	cmd.exe
PID 1052 wrote to memory of 1972	1052	50DA248332E17121AF01CD7929069B7F.exe	cmd.exe
PID 1052 wrote to memory of 1972	1052	50DA248332E17121AF01CD7929069B7F.exe	cmd.exe
PID 1972 wrote to memory of 472	1972	cmd.exe	risker.exe
PID 1972 wrote to memory of 472	1972	cmd.exe	risker.exe
PID 1972 wrote to memory of 472	1972	cmd.exe	risker.exe
PID 1972 wrote to memory of 472	1972	cmd.exe	risker.exe
PID 1052 wrote to memory of 840	1052	50DA248332E17121AF01CD7929069B7F.exe	cmd.exe
PID 1052 wrote to memory of 840	1052	50DA248332E17121AF01CD7929069B7F.exe	cmd.exe
PID 1052 wrote to memory of 840	1052	50DA248332E17121AF01CD7929069B7F.exe	cmd.exe
PID 1052 wrote to memory of 840	1052	50DA248332E17121AF01CD7929069B7F.exe	cmd.exe
PID 840 wrote to memory of 1392	840	cmd.exe	timeout.exe
PID 840 wrote to memory of 1392	840	cmd.exe	timeout.exe
PID 840 wrote to memory of 1392	840	cmd.exe	timeout.exe
PID 840 wrote to memory of 1392	840	cmd.exe	timeout.exe
PID 472 wrote to memory of 612	472	risker.exe	DpEditor.exe
PID 472 wrote to memory of 612	472	risker.exe	DpEditor.exe
PID 472 wrote to memory of 612	472	risker.exe	DpEditor.exe
PID 472 wrote to memory of 612	472	risker.exe	DpEditor.exe

C:\Users\Admin\AppData\Local\Temp\50DA248332E17121AF01CD7929069B7F.exe
"C:\Users\Admin\AppData\Local\Temp\50DA248332E17121AF01CD7929069B7F.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Roaming\C97D5738C9582AEF\risker.exe
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Roaming\C97D5738C9582AEF\risker.exe
C:\Users\Admin\AppData\Roaming\C97D5738C9582AEF\risker.exe
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:472

C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
"C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:612

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout -t 3 && del "C:\Users\Admin\AppData\Local\Temp\50DA248332E17121AF01CD7929069B7F.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\SysWOW64\timeout.exe
timeout -t 3
3⤵
- Delays execution with timeout.exe
PID:1392

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C97D5738C9582AEF\risker.exe
Filesize
2.6MB

MD5
44924536076bd4c828317f68fada16bc

SHA1
8e55fa475d754ee14a84b1bbd0ca281c191146bf

SHA256
ed633091770f5a3f3d363480491057c8010ed91e67caec2b2d62d0ebb0b6c229

SHA512
c0b13f69777cd128f56416b3177e1ea0d25fd68bf093ac3f3082c697209b38ba7f28e0b5cca78b992383f0371937a8bc40a43c30152072f12216142ad5ebbba1

Download Submit
C:\Users\Admin\AppData\Roaming\C97D5738C9582AEF\risker.exe
Filesize
2.6MB

MD5
44924536076bd4c828317f68fada16bc

SHA1
8e55fa475d754ee14a84b1bbd0ca281c191146bf

SHA256
ed633091770f5a3f3d363480491057c8010ed91e67caec2b2d62d0ebb0b6c229

SHA512
c0b13f69777cd128f56416b3177e1ea0d25fd68bf093ac3f3082c697209b38ba7f28e0b5cca78b992383f0371937a8bc40a43c30152072f12216142ad5ebbba1

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
Filesize
2.6MB

MD5
44924536076bd4c828317f68fada16bc

SHA1
8e55fa475d754ee14a84b1bbd0ca281c191146bf

SHA256
ed633091770f5a3f3d363480491057c8010ed91e67caec2b2d62d0ebb0b6c229

SHA512
c0b13f69777cd128f56416b3177e1ea0d25fd68bf093ac3f3082c697209b38ba7f28e0b5cca78b992383f0371937a8bc40a43c30152072f12216142ad5ebbba1

Download Submit
\Users\Admin\AppData\Roaming\C97D5738C9582AEF\risker.exe
Filesize
2.6MB

MD5
44924536076bd4c828317f68fada16bc

SHA1
8e55fa475d754ee14a84b1bbd0ca281c191146bf

SHA256
ed633091770f5a3f3d363480491057c8010ed91e67caec2b2d62d0ebb0b6c229

SHA512
c0b13f69777cd128f56416b3177e1ea0d25fd68bf093ac3f3082c697209b38ba7f28e0b5cca78b992383f0371937a8bc40a43c30152072f12216142ad5ebbba1

Download Submit
\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
Filesize
2.6MB

MD5
44924536076bd4c828317f68fada16bc

SHA1
8e55fa475d754ee14a84b1bbd0ca281c191146bf

SHA256
ed633091770f5a3f3d363480491057c8010ed91e67caec2b2d62d0ebb0b6c229

SHA512
c0b13f69777cd128f56416b3177e1ea0d25fd68bf093ac3f3082c697209b38ba7f28e0b5cca78b992383f0371937a8bc40a43c30152072f12216142ad5ebbba1

Download Submit
memory/472-70-0x0000000000B20000-0x0000000001200000-memory.dmp

Filesize
6.9MB

Download
memory/472-80-0x00000000779D0000-0x0000000077B50000-memory.dmp

Filesize
1.5MB

Download
memory/472-62-0x0000000000000000-mapping.dmp

Download
memory/472-79-0x0000000000B20000-0x0000000001200000-memory.dmp

Filesize
6.9MB

Download
memory/472-65-0x0000000000B20000-0x0000000001200000-memory.dmp

Filesize
6.9MB

Download
memory/472-66-0x0000000000B20000-0x0000000001200000-memory.dmp

Filesize
6.9MB

Download
memory/472-67-0x0000000000B20000-0x0000000001200000-memory.dmp

Filesize
6.9MB

Download
memory/472-68-0x0000000000B20000-0x0000000001200000-memory.dmp

Filesize
6.9MB

Download
memory/472-71-0x00000000779D0000-0x0000000077B50000-memory.dmp

Filesize
1.5MB

Download
memory/612-76-0x0000000000000000-mapping.dmp

Download
memory/612-81-0x00000000011D0000-0x00000000018B0000-memory.dmp

Filesize
6.9MB

Download
memory/612-87-0x00000000011D0000-0x00000000018B0000-memory.dmp

Filesize
6.9MB

Download
memory/612-86-0x00000000779D0000-0x0000000077B50000-memory.dmp

Filesize
1.5MB

Download
memory/612-85-0x00000000011D0000-0x00000000018B0000-memory.dmp

Filesize
6.9MB

Download
memory/612-84-0x00000000011D0000-0x00000000018B0000-memory.dmp

Filesize
6.9MB

Download
memory/612-83-0x00000000011D0000-0x00000000018B0000-memory.dmp

Filesize
6.9MB

Download
memory/612-82-0x00000000011D0000-0x00000000018B0000-memory.dmp

Filesize
6.9MB

Download
memory/840-72-0x0000000000000000-mapping.dmp

Download
memory/1052-55-0x00000000011B0000-0x0000000001D44000-memory.dmp

Filesize
11.6MB

Download
memory/1052-74-0x00000000011B0000-0x0000000001D44000-memory.dmp

Filesize
11.6MB

Download
memory/1052-58-0x00000000011B0000-0x0000000001D44000-memory.dmp

Filesize
11.6MB

Download
memory/1052-54-0x0000000075C91000-0x0000000075C93000-memory.dmp

Filesize
8KB

Download
memory/1392-73-0x0000000000000000-mapping.dmp

Download
memory/1972-59-0x0000000000000000-mapping.dmp

Download
memory/1972-69-0x0000000002140000-0x0000000002820000-memory.dmp

Filesize
6.9MB

Download