General
-
Target
b36f1aba7155ea371ae7bdaeef70f14c46040ec00a9a7dccad4e607852e13b4c
-
Size
7.3MB
-
Sample
220809-16bq4ahagr
-
MD5
df35dd9a6f211651c51e99928eb21cf1
-
SHA1
84b644f6e404c0c6eac3af7768d7d44c01dbd9bb
-
SHA256
b36f1aba7155ea371ae7bdaeef70f14c46040ec00a9a7dccad4e607852e13b4c
-
SHA512
b6a21f19adc1a302677da6f1c8f7bcc6222b5d2edd4fb12f21c1c12a1d55aa93c8586ce25827f8c9f45d51003b5b2db106949c7791d98d9b474a10a99dcca1d6
Behavioral task
behavioral1
Sample
b36f1aba7155ea371ae7bdaeef70f14c46040ec00a9a7dccad4e607852e13b4c.exe
Resource
win7-20220718-en
Malware Config
Targets
-
-
Target
b36f1aba7155ea371ae7bdaeef70f14c46040ec00a9a7dccad4e607852e13b4c
-
Size
7.3MB
-
MD5
df35dd9a6f211651c51e99928eb21cf1
-
SHA1
84b644f6e404c0c6eac3af7768d7d44c01dbd9bb
-
SHA256
b36f1aba7155ea371ae7bdaeef70f14c46040ec00a9a7dccad4e607852e13b4c
-
SHA512
b6a21f19adc1a302677da6f1c8f7bcc6222b5d2edd4fb12f21c1c12a1d55aa93c8586ce25827f8c9f45d51003b5b2db106949c7791d98d9b474a10a99dcca1d6
-
Modifies security service
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
XMRig Miner payload
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Possible privilege escalation attempt
-
Stops running service(s)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Modifies file permissions
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-