Analysis
-
max time kernel
203s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 16:48
General
-
Target
78daf61dab16fb32fa150f65b6bb11d8b37b357330dd6a54b871bede1ea657d7.exe
-
Size
4.4MB
-
MD5
3259ccd136c48a65c7f9e7c55128759c
-
SHA1
ba7c198ce1009279427a51a0b30b4693378bcb2c
-
SHA256
78daf61dab16fb32fa150f65b6bb11d8b37b357330dd6a54b871bede1ea657d7
-
SHA512
6dfc74f6dac6bbf81946c8c3dbcd6a8a8ddbb558476c5061351d9b408348bc7537bcd153cc766460c433c88daf30b39772c8ad3c4e7a38c17453ffd68c26c0d9
-
SSDEEP
98304:/jZvtHpNeV/riwz58R42is6e3RXjOWDucCnp1DA9sv7o2s2kbsUOEGx4VKP3Q9OK:/jZv/djjqPdDsDbsU0akJyxL405+fiX
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\78daf61dab16fb32fa150f65b6bb11d8b37b357330dd6a54b871bede1ea657d7.exe"C:\Users\Admin\AppData\Local\Temp\78daf61dab16fb32fa150f65b6bb11d8b37b357330dd6a54b871bede1ea657d7.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5d2340ef740ece066503d415beb9ac276
SHA125a859b812ff4e5dd57150964ffea1de7b4d24f2
SHA2561e1b9669fd464401e53fbed81ec00e2af926b75ae8b7c6987709cc281c85f1af
SHA512e248ab2edd7a83557d57deae826fa3f0da0ec1ec2806599b239a320535f937eb5806ba962e5e7daa5bd0fb634e8b4b104e25a898ba0804857c3e7362c98106c7
-
Filesize
4.4MB
-
Filesize
548KB
-
Filesize
3.0MB
-
Filesize
1.6MB
-
Filesize
3.0MB
-
Filesize
1.6MB
-
Filesize
3.0MB
-
Filesize
1.6MB