Analysis
-
max time kernel
146s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-10-2022 20:51
Behavioral task
behavioral1
Sample
b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
General
-
Target
b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe
-
Size
556KB
-
MD5
84f7045e0d9adf61b6324a417b8795d0
-
SHA1
606b249b429c8cf269f35a4adb2ee7d2b168a338
-
SHA256
b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588
-
SHA512
5fd62fd6af271e64d00ec66dcb6c950e558a1be91678bddb418aa0a239babb231fa84cd07978398c63b1a801c6430b8a7fb9c15ed51986f70ecba975dc803728
-
SSDEEP
12288:Im33qtExkDx/b+NXdJqDBpwYxaPTpU51DQPZUNVnILwuQhNajv/OD5wziM:H3Tkx8XdADzwpT81DQBUvILwrhcjvyQ
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Wine b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe -
resource yara_rule behavioral1/memory/1188-54-0x0000000000400000-0x000000000053C000-memory.dmp themida behavioral1/memory/1188-56-0x0000000000400000-0x000000000053C000-memory.dmp themida behavioral1/memory/1188-57-0x0000000000400000-0x000000000053C000-memory.dmp themida behavioral1/memory/1188-58-0x0000000000400000-0x000000000053C000-memory.dmp themida behavioral1/memory/1188-59-0x0000000000400000-0x000000000053C000-memory.dmp themida -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1188 b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe"C:\Users\Admin\AppData\Local\Temp\b58b57edcb3e835e7af3e35d2fcf560336c8af6ce0d04aeb9c1fdc64b5840588.exe"1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1188