allcome | 82112a8c76d6bab37acadc1e1a113e43b6dc966f48b9f2a0cc8fdbd844ee2f7a

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	L4ei73Ga.exe

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
3932	a28nI1TL.exe
3748	i88g3WPd.exe
2732	L4ei73Ga.exe
4956	i88g3WPd.exe
3196	DllResource.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	L4ei73Ga.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	L4ei73Ga.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	i88g3WPd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	a28nI1TL.exe

Loads dropped DLL 3 IoCs

pid	Process
664	InstallUtil.exe
664	InstallUtil.exe
664	InstallUtil.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0006000000021b42-166.dat	themida
behavioral2/files/0x0006000000021b42-167.dat	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	L4ei73Ga.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1912 set thread context of 664	1912	lrPBx4qjVQLL.exe	88
PID 3748 set thread context of 4956	3748	i88g3WPd.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4492	schtasks.exe
3228	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1256	PING.EXE

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1912	lrPBx4qjVQLL.exe
1912	lrPBx4qjVQLL.exe
1912	lrPBx4qjVQLL.exe
1912	lrPBx4qjVQLL.exe
1912	lrPBx4qjVQLL.exe
1912	lrPBx4qjVQLL.exe
1912	lrPBx4qjVQLL.exe
1912	lrPBx4qjVQLL.exe
1912	lrPBx4qjVQLL.exe
1912	lrPBx4qjVQLL.exe
3748	i88g3WPd.exe
3748	i88g3WPd.exe
3748	i88g3WPd.exe
3748	i88g3WPd.exe
3932	a28nI1TL.exe
3932	a28nI1TL.exe
3932	a28nI1TL.exe
3932	a28nI1TL.exe
3932	a28nI1TL.exe
3932	a28nI1TL.exe
3932	a28nI1TL.exe
3932	a28nI1TL.exe
3932	a28nI1TL.exe
3932	a28nI1TL.exe
3196	DllResource.exe
3196	DllResource.exe
3196	DllResource.exe
3196	DllResource.exe
3196	DllResource.exe
3196	DllResource.exe
3196	DllResource.exe
3196	DllResource.exe
3196	DllResource.exe
3196	DllResource.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3748	i88g3WPd.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2760	1912	lrPBx4qjVQLL.exe	86
PID 1912 wrote to memory of 2760	1912	lrPBx4qjVQLL.exe	86
PID 1912 wrote to memory of 2760	1912	lrPBx4qjVQLL.exe	86
PID 1912 wrote to memory of 1192	1912	lrPBx4qjVQLL.exe	87
PID 1912 wrote to memory of 1192	1912	lrPBx4qjVQLL.exe	87
PID 1912 wrote to memory of 1192	1912	lrPBx4qjVQLL.exe	87
PID 1912 wrote to memory of 664	1912	lrPBx4qjVQLL.exe	88
PID 1912 wrote to memory of 664	1912	lrPBx4qjVQLL.exe	88
PID 1912 wrote to memory of 664	1912	lrPBx4qjVQLL.exe	88
PID 1912 wrote to memory of 664	1912	lrPBx4qjVQLL.exe	88
PID 1912 wrote to memory of 664	1912	lrPBx4qjVQLL.exe	88
PID 664 wrote to memory of 3932	664	InstallUtil.exe	89
PID 664 wrote to memory of 3932	664	InstallUtil.exe	89
PID 664 wrote to memory of 3932	664	InstallUtil.exe	89
PID 664 wrote to memory of 3748	664	InstallUtil.exe	90
PID 664 wrote to memory of 3748	664	InstallUtil.exe	90
PID 664 wrote to memory of 3748	664	InstallUtil.exe	90
PID 3748 wrote to memory of 4956	3748	i88g3WPd.exe	93
PID 3748 wrote to memory of 4956	3748	i88g3WPd.exe	93
PID 3748 wrote to memory of 4956	3748	i88g3WPd.exe	93
PID 3748 wrote to memory of 4956	3748	i88g3WPd.exe	93
PID 3748 wrote to memory of 4956	3748	i88g3WPd.exe	93
PID 3748 wrote to memory of 4956	3748	i88g3WPd.exe	93
PID 3748 wrote to memory of 4956	3748	i88g3WPd.exe	93
PID 3748 wrote to memory of 4956	3748	i88g3WPd.exe	93
PID 3748 wrote to memory of 4956	3748	i88g3WPd.exe	93
PID 3748 wrote to memory of 4956	3748	i88g3WPd.exe	93
PID 664 wrote to memory of 2732	664	InstallUtil.exe	94
PID 664 wrote to memory of 2732	664	InstallUtil.exe	94
PID 4956 wrote to memory of 4492	4956	i88g3WPd.exe	95
PID 4956 wrote to memory of 4492	4956	i88g3WPd.exe	95
PID 4956 wrote to memory of 4492	4956	i88g3WPd.exe	95
PID 3932 wrote to memory of 3228	3932	a28nI1TL.exe	97
PID 3932 wrote to memory of 3228	3932	a28nI1TL.exe	97
PID 3932 wrote to memory of 3228	3932	a28nI1TL.exe	97
PID 3932 wrote to memory of 3196	3932	a28nI1TL.exe	99
PID 3932 wrote to memory of 3196	3932	a28nI1TL.exe	99
PID 3932 wrote to memory of 3196	3932	a28nI1TL.exe	99
PID 3932 wrote to memory of 2976	3932	a28nI1TL.exe	100
PID 3932 wrote to memory of 2976	3932	a28nI1TL.exe	100
PID 3932 wrote to memory of 2976	3932	a28nI1TL.exe	100
PID 2976 wrote to memory of 2604	2976	cmd.exe	102
PID 2976 wrote to memory of 2604	2976	cmd.exe	102
PID 2976 wrote to memory of 2604	2976	cmd.exe	102
PID 2976 wrote to memory of 1256	2976	cmd.exe	103
PID 2976 wrote to memory of 1256	2976	cmd.exe	103
PID 2976 wrote to memory of 1256	2976	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\lrPBx4qjVQLL.exe
"C:\Users\Admin\AppData\Local\Temp\lrPBx4qjVQLL.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Users\Admin\AppData\Roaming\a28nI1TL.exe
    "C:\Users\Admin\AppData\Roaming\a28nI1TL.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\TypeRes\DllResource.exe"
      4⤵
      Creates scheduled task(s)
      PID:3228
  - - C:\Users\Admin\TypeRes\DllResource.exe
      "C:\Users\Admin\TypeRes\DllResource.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3196
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Roaming\a28nI1TL.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2604
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        Runs ping.exe
        
        PID:1256
- - C:\Users\Admin\AppData\Roaming\i88g3WPd.exe
    "C:\Users\Admin\AppData\Roaming\i88g3WPd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Users\Admin\AppData\Roaming\i88g3WPd.exe
      "C:\Users\Admin\AppData\Roaming\i88g3WPd.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4956
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:4492
- - C:\Users\Admin\AppData\Local\Temp\L4ei73Ga.exe
    "C:\Users\Admin\AppData\Local\Temp\L4ei73Ga.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    PID:2732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery