Resubmissions
31/10/2022, 22:55
221031-2wcfbadhf831/10/2022, 22:53
221031-2t11wsdhf2925/09/2022, 04:01
220925-elhg9adbc81015/09/2022, 10:54
220915-mzjapsgeej9Analysis
- max time kernel
91s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
15/09/2022, 10:54
General
- Target bgdwubmodm.dll
- Size 10.3MB
- Sample220915-mzjapsgeej
- SHA256 3da15b7582aa2e324d7e8a18ca4610fb20f69985b09f1c1490e6a99dcde6e305
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 12 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bgdwubmodm.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bgdwubmodm.dll,#12⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 7763⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2688 -ip 26881⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2688-133-0x0000000077520000-0x00000000776C3000-memory.dmp
memory/2688-134-0x00000000021B0000-0x0000000003D34000-memory.dmp
memory/2688-135-0x00000000021B0000-0x0000000003D34000-memory.dmp
memory/2688-136-0x00000000021B0000-0x0000000003D34000-memory.dmp
memory/2688-137-0x00000000021B0000-0x0000000003D34000-memory.dmp
memory/2688-138-0x00000000021B0000-0x0000000003D34000-memory.dmp
memory/2688-139-0x00000000021B0000-0x0000000003D34000-memory.dmp
memory/2688-140-0x00000000021B0000-0x0000000003D34000-memory.dmp
memory/2688-141-0x00000000021B0000-0x0000000003D34000-memory.dmp
memory/2688-142-0x00000000021B0000-0x0000000003D34000-memory.dmp
memory/2688-143-0x00000000021B0000-0x0000000003D34000-memory.dmp
memory/2688-144-0x00000000021B0000-0x0000000003D34000-memory.dmp
memory/2688-145-0x00000000021B0000-0x0000000003D34000-memory.dmp
memory/2688-146-0x0000000077520000-0x00000000776C3000-memory.dmp