redline | f8a941938484a00306232e77b8af41e7f81df56e4aa9864a2b59ea8ebfbc892b

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nvdrivesllapi.exe

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
4068	brave.exe
1844	chrome.exe
2580	ofg.exe
3460	GoogleUpdate.exe
1324	nvdrivesllapi.exe

Modifies Windows Firewall 1 TTPs 3 IoCs

evasion

Modify Existing Service

T1031

pid	Process
3432	netsh.exe
5104	netsh.exe
2496	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nvdrivesllapi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nvdrivesllapi.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	nvdrivesllapi.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0006000000022e41-197.dat	themida
behavioral2/files/0x0006000000022e41-198.dat	themida
behavioral2/memory/1324-204-0x00000000009F0000-0x0000000001FB4000-memory.dmp	themida
behavioral2/memory/1324-205-0x00000000009F0000-0x0000000001FB4000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nvdrivesllapi.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 100200	1628	2a1fdac565b24b16cb78c4737ba95c4b.exe	84
PID 1844 set thread context of 3460	1844	chrome.exe	103

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\GoogleUpdate.exe	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4792	SCHTASKS.exe
1856	SCHTASKS.exe
4624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
100200	AppLaunch.exe
100200	AppLaunch.exe
2140	powershell.exe
2140	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	100200	AppLaunch.exe
Token: SeDebugPrivilege	2580	ofg.exe
Token: SeDebugPrivilege	2140	powershell.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 100200	1628	2a1fdac565b24b16cb78c4737ba95c4b.exe	84
PID 1628 wrote to memory of 100200	1628	2a1fdac565b24b16cb78c4737ba95c4b.exe	84
PID 1628 wrote to memory of 100200	1628	2a1fdac565b24b16cb78c4737ba95c4b.exe	84
PID 1628 wrote to memory of 100200	1628	2a1fdac565b24b16cb78c4737ba95c4b.exe	84
PID 1628 wrote to memory of 100200	1628	2a1fdac565b24b16cb78c4737ba95c4b.exe	84
PID 100200 wrote to memory of 4068	100200	AppLaunch.exe	92
PID 100200 wrote to memory of 4068	100200	AppLaunch.exe	92
PID 100200 wrote to memory of 1844	100200	AppLaunch.exe	93
PID 100200 wrote to memory of 1844	100200	AppLaunch.exe	93
PID 100200 wrote to memory of 1844	100200	AppLaunch.exe	93
PID 1844 wrote to memory of 2140	1844	chrome.exe	94
PID 1844 wrote to memory of 2140	1844	chrome.exe	94
PID 1844 wrote to memory of 2140	1844	chrome.exe	94
PID 1844 wrote to memory of 4792	1844	chrome.exe	96
PID 1844 wrote to memory of 4792	1844	chrome.exe	96
PID 1844 wrote to memory of 4792	1844	chrome.exe	96
PID 100200 wrote to memory of 2580	100200	AppLaunch.exe	98
PID 100200 wrote to memory of 2580	100200	AppLaunch.exe	98
PID 2580 wrote to memory of 1620	2580	ofg.exe	99
PID 2580 wrote to memory of 1620	2580	ofg.exe	99
PID 1844 wrote to memory of 1856	1844	chrome.exe	101
PID 1844 wrote to memory of 1856	1844	chrome.exe	101
PID 1844 wrote to memory of 1856	1844	chrome.exe	101
PID 1844 wrote to memory of 3460	1844	chrome.exe	103
PID 1844 wrote to memory of 3460	1844	chrome.exe	103
PID 1844 wrote to memory of 3460	1844	chrome.exe	103
PID 1620 wrote to memory of 4624	1620	cmd.exe	104
PID 1620 wrote to memory of 4624	1620	cmd.exe	104
PID 1844 wrote to memory of 3460	1844	chrome.exe	103
PID 1844 wrote to memory of 3460	1844	chrome.exe	103
PID 1844 wrote to memory of 3460	1844	chrome.exe	103
PID 1844 wrote to memory of 3460	1844	chrome.exe	103
PID 1844 wrote to memory of 3460	1844	chrome.exe	103
PID 1844 wrote to memory of 3460	1844	chrome.exe	103
PID 3460 wrote to memory of 3432	3460	GoogleUpdate.exe	105
PID 3460 wrote to memory of 3432	3460	GoogleUpdate.exe	105
PID 3460 wrote to memory of 3432	3460	GoogleUpdate.exe	105
PID 3460 wrote to memory of 5104	3460	GoogleUpdate.exe	106
PID 3460 wrote to memory of 5104	3460	GoogleUpdate.exe	106
PID 3460 wrote to memory of 5104	3460	GoogleUpdate.exe	106
PID 3460 wrote to memory of 2496	3460	GoogleUpdate.exe	108
PID 3460 wrote to memory of 2496	3460	GoogleUpdate.exe	108
PID 3460 wrote to memory of 2496	3460	GoogleUpdate.exe	108
PID 4068 wrote to memory of 1324	4068	brave.exe	111
PID 4068 wrote to memory of 1324	4068	brave.exe	111
PID 1324 wrote to memory of 2972	1324	nvdrivesllapi.exe	113
PID 1324 wrote to memory of 2972	1324	nvdrivesllapi.exe	113

C:\Users\Admin\AppData\Local\Temp\2a1fdac565b24b16cb78c4737ba95c4b.exe
"C:\Users\Admin\AppData\Local\Temp\2a1fdac565b24b16cb78c4737ba95c4b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:100200
- - C:\Users\Admin\AppData\Local\Microsoft\brave.exe
    "C:\Users\Admin\AppData\Local\Microsoft\brave.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\nvdrivesllapi.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\nvdrivesllapi.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Executes dropped EXE
      Checks BIOS information in registry
      Checks computer location settings
      Checks whether UAC is enabled
      Suspicious use of WriteProcessMemory
      PID:1324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
        5⤵
        
        PID:2972
- - C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
    "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2140
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4792
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1856
  - - C:\Windows\GoogleUpdate.exe
      C:\Windows\GoogleUpdate.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3460
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
        5⤵
        Modifies Windows Firewall
        
        PID:3432
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:5104
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:2496
- - C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
    "C:\Users\Admin\AppData\Local\Microsoft\ofg.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C schtasks /create /tn \o5jbkg8hsq /tr "C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \o5jbkg8hsq /tr "C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Creates scheduled task(s)
        
        PID:4624

C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
1⤵
PID:5236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery