eb6d78909e63e19d449987908320da9a50ca7f480b4cffe2989ff9f4f4fd542c

Analysis

max time kernel
237s
max time network
252s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SoftV2.exe
Size

3.8MB
MD5

624d887c50cd38398904002ffcbc732a
SHA1

0dbc3aad0b27609d2b02074e7bf595f0da44c642
SHA256

eb6d78909e63e19d449987908320da9a50ca7f480b4cffe2989ff9f4f4fd542c
SHA512

9b4e95d5aa4b2268ef47a4bfa07780ec1b9bad14cf8cfac1005565be0025062568ad8d38f06b27bb3ef8e4cfcbeab1ec9cd352ae099b65d15fbbc85249842ddb
SSDEEP

98304:WLzBJJQF6cmSth42QvzaIJjmkc6bx8IaVqJ3N79YqFkgs800G5oM5:mwF6othWrpbatqJl9FFuj6W

Score

9^/10

evasion upx

Malware Config

Signatures

Enumerates VirtualBox DLL files 2 TTPs 10 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	\??\c:\windows\SysWOW64\vboxmrxnp.dll	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\vboxoglerrorspu.dll	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\vboxoglfeedbackspu.dll	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\vboxoglpackspu.dll	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\vboxdisp.dll	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\vboxogl.dll	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\vboxoglarrayspu.dll	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\vboxoglcrutil.dll	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\vboxoglpassthroughspu.dll	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\vboxhook.dll	SoftV2.exe

Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs

evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	\??\c:\windows\SysWOW64\drivers\VBoxMouse.sys	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\drivers\VBoxGuest.sys	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\drivers\VBoxSF.sys	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\drivers\VBoxVideo.sys	SoftV2.exe

Looks for VirtualBox executables on disk 2 TTPs 3 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	\??\c:\windows\SysWOW64\vboxservice.exe	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\vboxtray.exe	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\VBoxControl.exe	SoftV2.exe

Looks for VMWare drivers on disk 2 TTPs 2 IoCs

evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	\??\c:\windows\SysWOW64\drivers\vmmouse.sys	SoftV2.exe
File opened (read-only)	\??\c:\windows\SysWOW64\drivers\vmhgfs.sys	SoftV2.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5060-132-0x0000000000490000-0x0000000000BA9000-memory.dmp	upx
behavioral2/memory/5060-133-0x0000000000490000-0x0000000000BA9000-memory.dmp	upx
behavioral2/memory/5060-134-0x0000000000490000-0x0000000000BA9000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\SoftV2.exe
"C:\Users\Admin\AppData\Local\Temp\SoftV2.exe"
1⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox drivers on disk
- Looks for VirtualBox executables on disk
- Looks for VMWare drivers on disk
PID:5060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5060-132-0x0000000000490000-0x0000000000BA9000-memory.dmp

Filesize
7.1MB

Download
memory/5060-133-0x0000000000490000-0x0000000000BA9000-memory.dmp

Filesize
7.1MB

Download
memory/5060-134-0x0000000000490000-0x0000000000BA9000-memory.dmp

Filesize
7.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads