Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
21-10-2022 11:22
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
General
-
Target
file.exe
-
Size
5.3MB
-
MD5
192a51ce49ce579f5816a8a75586e048
-
SHA1
f6074369b40edd8210a87b27cc0f20644def41e5
-
SHA256
d3dd1a4eff9a3371d839a9cbdcd040edb03c5ac3140e142e6bf398905a9afad7
-
SHA512
0f7ac42bd2725c65f9842af46abf1c339a153e0a2f79eb865f70bf9e214844fdaa0966374c04f4133f398272167408001d38dc26f9803ad70ad697d1b585357a
-
SSDEEP
98304:BN5tzNYV3fp6KqaEtnyPh+ePqMuax7E/hToelmYigzFUcu0rln0aPE0:BZRY1fp6b0Ph+eLpRYhTonYigz2gV/
Malware Config
Extracted
vidar
55
1679
http://138.201.90.120:80
-
profile_id
1679
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe -
Loads dropped DLL 2 IoCs
Processes:
file.exepid process 992 file.exe 992 file.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/992-55-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-56-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-58-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-57-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-60-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-61-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-62-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-63-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-65-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-66-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-67-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-68-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-69-0x0000000001320000-0x00000000021CD000-memory.dmp themida behavioral1/memory/992-94-0x0000000001320000-0x00000000021CD000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
file.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
file.exepid process 992 file.exe 992 file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString file.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 file.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2020 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 584 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
file.exepid process 992 file.exe 992 file.exe 992 file.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 584 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
file.execmd.exedescription pid process target process PID 992 wrote to memory of 1080 992 file.exe cmd.exe PID 992 wrote to memory of 1080 992 file.exe cmd.exe PID 992 wrote to memory of 1080 992 file.exe cmd.exe PID 992 wrote to memory of 1080 992 file.exe cmd.exe PID 1080 wrote to memory of 584 1080 cmd.exe taskkill.exe PID 1080 wrote to memory of 584 1080 cmd.exe taskkill.exe PID 1080 wrote to memory of 584 1080 cmd.exe taskkill.exe PID 1080 wrote to memory of 584 1080 cmd.exe taskkill.exe PID 1080 wrote to memory of 2020 1080 cmd.exe timeout.exe PID 1080 wrote to memory of 2020 1080 cmd.exe timeout.exe PID 1080 wrote to memory of 2020 1080 cmd.exe timeout.exe PID 1080 wrote to memory of 2020 1080 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" àBV/c taskkill /im file.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\file.exe" & del C:\PrograData\*.dll & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im file.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
memory/584-92-0x0000000000000000-mapping.dmp
-
memory/992-60-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-68-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-59-0x00000000778E0000-0x0000000077A60000-memory.dmpFilesize
1.5MB
-
memory/992-54-0x0000000076561000-0x0000000076563000-memory.dmpFilesize
8KB
-
memory/992-61-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-62-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-64-0x00000000778E0000-0x0000000077A60000-memory.dmpFilesize
1.5MB
-
memory/992-63-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-65-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-66-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-67-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-57-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-69-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-70-0x00000000778E0000-0x0000000077A60000-memory.dmpFilesize
1.5MB
-
memory/992-71-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/992-58-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-56-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-95-0x00000000778E0000-0x0000000077A60000-memory.dmpFilesize
1.5MB
-
memory/992-55-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/992-94-0x0000000001320000-0x00000000021CD000-memory.dmpFilesize
14.7MB
-
memory/1080-91-0x0000000000000000-mapping.dmp
-
memory/2020-93-0x0000000000000000-mapping.dmp