Analysis
- max time kernel
135s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
12/10/2022, 14:27
General
- Target file.exe
- Size 4.2MB
- Sample221012-rsefdsfdcq
- SHA256 50c809ce4ba740d1ab00609dd6d2c3e0d5d2cef44d40da4e204ba7296a42d5f1
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2092-132-0x0000000000400000-0x0000000000BA3000-memory.dmp
memory/2092-133-0x0000000000400000-0x0000000000BA3000-memory.dmp
memory/2092-135-0x0000000000400000-0x0000000000BA3000-memory.dmp
memory/2092-136-0x0000000000400000-0x0000000000BA3000-memory.dmp
memory/2092-137-0x0000000000400000-0x0000000000BA3000-memory.dmp
memory/2092-138-0x0000000000400000-0x0000000000BA3000-memory.dmp
memory/2092-139-0x0000000077C90000-0x0000000077E33000-memory.dmp
memory/2092-140-0x0000000000400000-0x0000000000BA3000-memory.dmp
memory/2092-141-0x00000000054E0000-0x0000000005A84000-memory.dmp
memory/2092-142-0x0000000005AE0000-0x0000000005B72000-memory.dmp
memory/2092-143-0x0000000000400000-0x0000000000BA3000-memory.dmp
memory/2092-144-0x0000000077C90000-0x0000000077E33000-memory.dmp
memory/2092-145-0x0000000005BD0000-0x00000000061E8000-memory.dmp
memory/2092-146-0x0000000006280000-0x000000000638A000-memory.dmp
memory/2092-147-0x00000000063B0000-0x00000000063C2000-memory.dmp
memory/2092-148-0x00000000063D0000-0x000000000640C000-memory.dmp
memory/2092-149-0x0000000007520000-0x0000000007586000-memory.dmp
memory/2092-150-0x0000000007850000-0x0000000007A12000-memory.dmp
memory/2092-151-0x0000000007A20000-0x0000000007F4C000-memory.dmp
memory/2092-152-0x0000000000400000-0x0000000000BA3000-memory.dmp
memory/2092-153-0x0000000077C90000-0x0000000077E33000-memory.dmp