Analysis
-
max time kernel
290s -
max time network
294s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-10-2022 03:49
Behavioral task
behavioral1
Sample
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe
Resource
win7-20220812-en
General
-
Target
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe
-
Size
8.2MB
-
MD5
23150d8faa66ce23299e2c032b8fd62f
-
SHA1
26c7c604d01f784931a3a95f1efeb56bfe1aec69
-
SHA256
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b
-
SHA512
17ae25cce526a5eb11202cc779f5d62fc45b14a4d547e2eb88694dc21c83fdb853731adfd7cb47fb3499f140ddedf61175415504a0c93cb2ed3b3f25e989f5e7
-
SSDEEP
196608:JzxikPsLoM1ZPdUYcoV1alsmMzU5tReoS+P6n:JzIkP7M1ZP64alnB5t5SF
Malware Config
Extracted
systembc
89.22.225.242:4193
195.2.93.22:4193
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exemigeyih quipaha xajiced banokora ririb bevirov kimatis.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Executes dropped EXE 1 IoCs
Processes:
migeyih quipaha xajiced banokora ririb bevirov kimatis.exepid process 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exemigeyih quipaha xajiced banokora ririb bevirov kimatis.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion migeyih quipaha xajiced banokora ririb bevirov kimatis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1984 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exepid process 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe -
Processes:
resource yara_rule behavioral1/memory/2036-55-0x0000000000A30000-0x0000000001271000-memory.dmp themida behavioral1/memory/2036-56-0x0000000000A30000-0x0000000001271000-memory.dmp themida \Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe themida C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe themida behavioral1/memory/552-69-0x0000000000F70000-0x00000000017B1000-memory.dmp themida behavioral1/memory/552-70-0x0000000000F70000-0x00000000017B1000-memory.dmp themida behavioral1/memory/2036-72-0x0000000000A30000-0x0000000001271000-memory.dmp themida behavioral1/memory/552-76-0x0000000000F70000-0x00000000017B1000-memory.dmp themida behavioral1/memory/552-87-0x0000000000F70000-0x00000000017B1000-memory.dmp themida -
Processes:
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exemigeyih quipaha xajiced banokora ririb bevirov kimatis.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
migeyih quipaha xajiced banokora ririb bevirov kimatis.exedescription pid process target process PID 552 set thread context of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exemigeyih quipaha xajiced banokora ririb bevirov kimatis.exepid process 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.execmd.exemigeyih quipaha xajiced banokora ririb bevirov kimatis.exedescription pid process target process PID 2036 wrote to memory of 784 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe schtasks.exe PID 2036 wrote to memory of 784 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe schtasks.exe PID 2036 wrote to memory of 784 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe schtasks.exe PID 2036 wrote to memory of 784 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe schtasks.exe PID 2036 wrote to memory of 552 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe migeyih quipaha xajiced banokora ririb bevirov kimatis.exe PID 2036 wrote to memory of 552 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe migeyih quipaha xajiced banokora ririb bevirov kimatis.exe PID 2036 wrote to memory of 552 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe migeyih quipaha xajiced banokora ririb bevirov kimatis.exe PID 2036 wrote to memory of 552 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe migeyih quipaha xajiced banokora ririb bevirov kimatis.exe PID 2036 wrote to memory of 1984 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe cmd.exe PID 2036 wrote to memory of 1984 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe cmd.exe PID 2036 wrote to memory of 1984 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe cmd.exe PID 2036 wrote to memory of 1984 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe cmd.exe PID 1984 wrote to memory of 1352 1984 cmd.exe chcp.com PID 1984 wrote to memory of 1352 1984 cmd.exe chcp.com PID 1984 wrote to memory of 1352 1984 cmd.exe chcp.com PID 1984 wrote to memory of 1352 1984 cmd.exe chcp.com PID 1984 wrote to memory of 1496 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 1496 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 1496 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 1496 1984 cmd.exe PING.EXE PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe"C:\Users\Admin\AppData\Local\Temp\bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe"C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exeFilesize
795.2MB
MD55447fa8fde4c52c62d163be3e9d9ada1
SHA16bf49b6a6118133d384aa99dde2a2330f5198e26
SHA25632650671503ab30ea8060338b09fe48662ab2a808fe0e97ae5093a5713a92ad7
SHA5120cbacfc88e13a567d885421e2113279ac67ec115ee077e50b45c25d61a29c3a4f6bb304698f9269e021e2c011b10beb4953b8efb982bc6929963c6be172175da
-
\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exeFilesize
795.2MB
MD55447fa8fde4c52c62d163be3e9d9ada1
SHA16bf49b6a6118133d384aa99dde2a2330f5198e26
SHA25632650671503ab30ea8060338b09fe48662ab2a808fe0e97ae5093a5713a92ad7
SHA5120cbacfc88e13a567d885421e2113279ac67ec115ee077e50b45c25d61a29c3a4f6bb304698f9269e021e2c011b10beb4953b8efb982bc6929963c6be172175da
-
memory/552-70-0x0000000000F70000-0x00000000017B1000-memory.dmpFilesize
8.3MB
-
memory/552-65-0x0000000000000000-mapping.dmp
-
memory/552-76-0x0000000000F70000-0x00000000017B1000-memory.dmpFilesize
8.3MB
-
memory/552-77-0x0000000002BC0000-0x0000000003301000-memory.dmpFilesize
7.3MB
-
memory/552-82-0x0000000000430000-0x0000000000487000-memory.dmpFilesize
348KB
-
memory/552-81-0x0000000000D30000-0x0000000000EA0000-memory.dmpFilesize
1.4MB
-
memory/552-80-0x0000000000D30000-0x0000000000EA0000-memory.dmpFilesize
1.4MB
-
memory/552-78-0x0000000002BC0000-0x0000000003301000-memory.dmpFilesize
7.3MB
-
memory/552-90-0x0000000000D30000-0x0000000000EA0000-memory.dmpFilesize
1.4MB
-
memory/552-87-0x0000000000F70000-0x00000000017B1000-memory.dmpFilesize
8.3MB
-
memory/552-69-0x0000000000F70000-0x00000000017B1000-memory.dmpFilesize
8.3MB
-
memory/552-79-0x0000000000D30000-0x0000000000EA0000-memory.dmpFilesize
1.4MB
-
memory/784-63-0x0000000000000000-mapping.dmp
-
memory/1128-89-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1128-83-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1128-85-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1352-74-0x0000000000000000-mapping.dmp
-
memory/1496-75-0x0000000000000000-mapping.dmp
-
memory/1984-71-0x0000000000000000-mapping.dmp
-
memory/2036-73-0x0000000000780000-0x00000000008F0000-memory.dmpFilesize
1.4MB
-
memory/2036-72-0x0000000000A30000-0x0000000001271000-memory.dmpFilesize
8.3MB
-
memory/2036-54-0x0000000076151000-0x0000000076153000-memory.dmpFilesize
8KB
-
memory/2036-68-0x00000000101C0000-0x0000000010A01000-memory.dmpFilesize
8.3MB
-
memory/2036-62-0x0000000000780000-0x00000000008F0000-memory.dmpFilesize
1.4MB
-
memory/2036-61-0x0000000002680000-0x0000000002DC1000-memory.dmpFilesize
7.3MB
-
memory/2036-60-0x0000000000780000-0x00000000008F0000-memory.dmpFilesize
1.4MB
-
memory/2036-59-0x0000000000780000-0x00000000008F0000-memory.dmpFilesize
1.4MB
-
memory/2036-58-0x0000000002680000-0x0000000002DC1000-memory.dmpFilesize
7.3MB
-
memory/2036-57-0x0000000002680000-0x0000000002DC1000-memory.dmpFilesize
7.3MB
-
memory/2036-56-0x0000000000A30000-0x0000000001271000-memory.dmpFilesize
8.3MB
-
memory/2036-55-0x0000000000A30000-0x0000000001271000-memory.dmpFilesize
8.3MB