redline | dcb4a5db6b0cf4459a1ce543feea4e90b5df60cf55df4a2513c967fdec37f50c

Virtualization/Sandbox Evasion

T1497

Processes:

Updater.exeoobeldr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	oobeldr.exe

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

Updater.exeoobeldr.exe

pid process

1368 Updater.exe
216 oobeldr.exe

pid	process
1368	Updater.exe
216	oobeldr.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Updater.exeoobeldr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oobeldr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	oobeldr.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

1956-57-0x0000000001340000-0x000000000219C000-memory.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	1956-57-0x0000000001340000-0x000000000219C000-memory.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/408-132-0x0000000000B70000-0x00000000019CC000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

Updater.exeoobeldr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	oobeldr.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Updater.exeoobeldr.exe

pid process

1368 Updater.exe
216 oobeldr.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3312 schtasks.exe
2732 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

1956-57-0x0000000001340000-0x000000000219C000-memory.exeUpdater.exeoobeldr.exe

pid process

408 1956-57-0x0000000001340000-0x000000000219C000-memory.exe
1368 Updater.exe
1368 Updater.exe
216 oobeldr.exe
216 oobeldr.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1956-57-0x0000000001340000-0x000000000219C000-memory.exe

description pid process

Token: SeDebugPrivilege 408 1956-57-0x0000000001340000-0x000000000219C000-memory.exe

pid	process
1368	Updater.exe
216	oobeldr.exe

pid	process
3312	schtasks.exe
2732	schtasks.exe

pid	process
408	1956-57-0x0000000001340000-0x000000000219C000-memory.exe
1368	Updater.exe
1368	Updater.exe
216	oobeldr.exe
216	oobeldr.exe

description	pid	process
Token: SeDebugPrivilege	408	1956-57-0x0000000001340000-0x000000000219C000-memory.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

1956-57-0x0000000001340000-0x000000000219C000-memory.exeUpdater.exeoobeldr.exe

description	pid	process	target process
PID 408 wrote to memory of 1368	408	1956-57-0x0000000001340000-0x000000000219C000-memory.exe	Updater.exe
PID 408 wrote to memory of 1368	408	1956-57-0x0000000001340000-0x000000000219C000-memory.exe	Updater.exe
PID 408 wrote to memory of 1368	408	1956-57-0x0000000001340000-0x000000000219C000-memory.exe	Updater.exe
PID 1368 wrote to memory of 3312	1368	Updater.exe	schtasks.exe
PID 1368 wrote to memory of 3312	1368	Updater.exe	schtasks.exe
PID 1368 wrote to memory of 3312	1368	Updater.exe	schtasks.exe
PID 216 wrote to memory of 2732	216	oobeldr.exe	schtasks.exe
PID 216 wrote to memory of 2732	216	oobeldr.exe	schtasks.exe
PID 216 wrote to memory of 2732	216	oobeldr.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\1956-57-0x0000000001340000-0x000000000219C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1956-57-0x0000000001340000-0x000000000219C000-memory.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408

C:\Users\Admin\AppData\Local\Temp\Updater.exe
"C:\Users\Admin\AppData\Local\Temp\Updater.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
3⤵
- Creates scheduled task(s)
PID:3312

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
2⤵
- Creates scheduled task(s)
PID:2732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

4

Virtualization/Sandbox Evasion

T1497

System Information Discovery

4