Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2022 10:12
General
-
Target
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe
-
Size
8.2MB
-
MD5
23150d8faa66ce23299e2c032b8fd62f
-
SHA1
26c7c604d01f784931a3a95f1efeb56bfe1aec69
-
SHA256
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b
-
SHA512
17ae25cce526a5eb11202cc779f5d62fc45b14a4d547e2eb88694dc21c83fdb853731adfd7cb47fb3499f140ddedf61175415504a0c93cb2ed3b3f25e989f5e7
-
SSDEEP
196608:JzxikPsLoM1ZPdUYcoV1alsmMzU5tReoS+P6n:JzIkP7M1ZP64alnB5t5SF
Malware Config
Extracted
systembc
89.22.225.242:4193
195.2.93.22:4193
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exemigeyih quipaha xajiced banokora ririb bevirov kimatis.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Executes dropped EXE 1 IoCs
Processes:
migeyih quipaha xajiced banokora ririb bevirov kimatis.exepid process 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exemigeyih quipaha xajiced banokora ririb bevirov kimatis.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion migeyih quipaha xajiced banokora ririb bevirov kimatis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe -
Processes:
resource yara_rule behavioral1/memory/4260-132-0x0000000000680000-0x0000000000EC1000-memory.dmp themida behavioral1/memory/4260-133-0x0000000000680000-0x0000000000EC1000-memory.dmp themida behavioral1/memory/4260-134-0x0000000000680000-0x0000000000EC1000-memory.dmp themida C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe themida behavioral1/memory/3628-143-0x0000000000AA0000-0x00000000012E1000-memory.dmp themida behavioral1/memory/4260-144-0x0000000000680000-0x0000000000EC1000-memory.dmp themida behavioral1/memory/3628-146-0x0000000000AA0000-0x00000000012E1000-memory.dmp themida behavioral1/memory/3628-161-0x0000000000AA0000-0x00000000012E1000-memory.dmp themida -
Processes:
migeyih quipaha xajiced banokora ririb bevirov kimatis.exebbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA migeyih quipaha xajiced banokora ririb bevirov kimatis.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
migeyih quipaha xajiced banokora ririb bevirov kimatis.exedescription pid process target process PID 3628 set thread context of 5040 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exemigeyih quipaha xajiced banokora ririb bevirov kimatis.exepid process 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.execmd.exemigeyih quipaha xajiced banokora ririb bevirov kimatis.exedescription pid process target process PID 4260 wrote to memory of 4508 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe schtasks.exe PID 4260 wrote to memory of 4508 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe schtasks.exe PID 4260 wrote to memory of 4508 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe schtasks.exe PID 4260 wrote to memory of 3628 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe migeyih quipaha xajiced banokora ririb bevirov kimatis.exe PID 4260 wrote to memory of 3628 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe migeyih quipaha xajiced banokora ririb bevirov kimatis.exe PID 4260 wrote to memory of 3628 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe migeyih quipaha xajiced banokora ririb bevirov kimatis.exe PID 4260 wrote to memory of 3600 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe cmd.exe PID 4260 wrote to memory of 3600 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe cmd.exe PID 4260 wrote to memory of 3600 4260 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe cmd.exe PID 3600 wrote to memory of 3880 3600 cmd.exe chcp.com PID 3600 wrote to memory of 3880 3600 cmd.exe chcp.com PID 3600 wrote to memory of 3880 3600 cmd.exe chcp.com PID 3600 wrote to memory of 4980 3600 cmd.exe PING.EXE PID 3600 wrote to memory of 4980 3600 cmd.exe PING.EXE PID 3600 wrote to memory of 4980 3600 cmd.exe PING.EXE PID 3628 wrote to memory of 5040 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 3628 wrote to memory of 5040 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 3628 wrote to memory of 5040 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 3628 wrote to memory of 5040 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe PID 3628 wrote to memory of 5040 3628 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe"C:\Users\Admin\AppData\Local\Temp\bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe"C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exeFilesize
809.2MB
MD569070d28d23e9115fb799b5cb02a45d9
SHA1de64936c28a814bf8951cda5c925c6de6543ad06
SHA2565596f297490375d4a517841afd8f6950ad445eb8d31147263dc6d37c108c1cc2
SHA512fa8114490f97f860570b5dde84d5e74eae3d46944b2535910d488264de03f10c866dba512468d04e3c001350e136bb9181c1841c13462f78cb26492dc7ba21d3
-
memory/3600-142-0x0000000000000000-mapping.dmp
-
memory/3628-153-0x000000000DDD0000-0x000000000DE27000-memory.dmpFilesize
348KB
-
memory/3628-162-0x00000000039C1000-0x0000000003B31000-memory.dmpFilesize
1.4MB
-
memory/3628-146-0x0000000000AA0000-0x00000000012E1000-memory.dmpFilesize
8.3MB
-
memory/3628-161-0x0000000000AA0000-0x00000000012E1000-memory.dmpFilesize
8.3MB
-
memory/3628-154-0x000000000DDD0000-0x000000000DE27000-memory.dmpFilesize
348KB
-
memory/3628-140-0x0000000000000000-mapping.dmp
-
memory/3628-152-0x00000000039C1000-0x0000000003B31000-memory.dmpFilesize
1.4MB
-
memory/3628-151-0x0000000003273000-0x00000000039B4000-memory.dmpFilesize
7.3MB
-
memory/3628-143-0x0000000000AA0000-0x00000000012E1000-memory.dmpFilesize
8.3MB
-
memory/3628-150-0x00000000039C1000-0x0000000003B31000-memory.dmpFilesize
1.4MB
-
memory/3628-149-0x0000000003273000-0x00000000039B4000-memory.dmpFilesize
7.3MB
-
memory/3880-147-0x0000000000000000-mapping.dmp
-
memory/4260-134-0x0000000000680000-0x0000000000EC1000-memory.dmpFilesize
8.3MB
-
memory/4260-132-0x0000000000680000-0x0000000000EC1000-memory.dmpFilesize
8.3MB
-
memory/4260-137-0x0000000003002000-0x0000000003743000-memory.dmpFilesize
7.3MB
-
memory/4260-145-0x000000000375D000-0x00000000038CD000-memory.dmpFilesize
1.4MB
-
memory/4260-144-0x0000000000680000-0x0000000000EC1000-memory.dmpFilesize
8.3MB
-
memory/4260-133-0x0000000000680000-0x0000000000EC1000-memory.dmpFilesize
8.3MB
-
memory/4260-135-0x0000000003002000-0x0000000003743000-memory.dmpFilesize
7.3MB
-
memory/4260-136-0x000000000375D000-0x00000000038CD000-memory.dmpFilesize
1.4MB
-
memory/4260-138-0x000000000375D000-0x00000000038CD000-memory.dmpFilesize
1.4MB
-
memory/4508-139-0x0000000000000000-mapping.dmp
-
memory/4980-148-0x0000000000000000-mapping.dmp
-
memory/5040-156-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/5040-158-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/5040-160-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/5040-155-0x0000000000000000-mapping.dmp