Analysis
-
max time kernel
172s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 15:11
Static task
static1
Behavioral task
behavioral1
Sample
45a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
45a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919.exe
Resource
win10v2004-20220812-en
General
-
Target
45a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919.exe
-
Size
105KB
-
MD5
98c82c84e321b228d9f4134805727dce
-
SHA1
9cf96f5f939db05e4aa9eb56852698c4ecfc5e0e
-
SHA256
45a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919
-
SHA512
470f64d46ebc8501582ff2d1bc60603a082129df52de0e7607ed5845f157469394360e3fb3d4357a0cfb586edef0d6b32e22dd4cab2b8e4ccbf386950151aaeb
-
SSDEEP
1536:D3tUqq7W3ginVdjO/EMb/+Lik5S+H7O6oad4oM/I4kWDqWSCtB:D3W/IXnLS5r8Sad4oM/lkIqWS6B
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
yjcltbhjqb.prepid process 948 yjcltbhjqb.pre -
Processes:
resource yara_rule behavioral2/memory/4656-134-0x0000000000400000-0x000000000044B520-memory.dmp upx behavioral2/memory/948-144-0x0000000000400000-0x000000000044B520-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win-helper = "C:\\Users\\Admin\\AppData\\Local\\Win\\win-helper.exe" svchost.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
svchost.exepid process 2044 svchost.exe 2044 svchost.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
45a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919.exesvchost.exeyjcltbhjqb.predescription pid process target process PID 4656 wrote to memory of 4920 4656 45a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919.exe svchost.exe PID 4656 wrote to memory of 4920 4656 45a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919.exe svchost.exe PID 4656 wrote to memory of 4920 4656 45a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919.exe svchost.exe PID 4656 wrote to memory of 4920 4656 45a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919.exe svchost.exe PID 4920 wrote to memory of 948 4920 svchost.exe yjcltbhjqb.pre PID 4920 wrote to memory of 948 4920 svchost.exe yjcltbhjqb.pre PID 4920 wrote to memory of 948 4920 svchost.exe yjcltbhjqb.pre PID 948 wrote to memory of 2044 948 yjcltbhjqb.pre svchost.exe PID 948 wrote to memory of 2044 948 yjcltbhjqb.pre svchost.exe PID 948 wrote to memory of 2044 948 yjcltbhjqb.pre svchost.exe PID 948 wrote to memory of 2044 948 yjcltbhjqb.pre svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919.exe"C:\Users\Admin\AppData\Local\Temp\45a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yjcltbhjqb.preC:\Users\Admin\AppData\Local\Temp\yjcltbhjqb.pre3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\yjcltbhjqb.preFilesize
105KB
MD598c82c84e321b228d9f4134805727dce
SHA19cf96f5f939db05e4aa9eb56852698c4ecfc5e0e
SHA25645a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919
SHA512470f64d46ebc8501582ff2d1bc60603a082129df52de0e7607ed5845f157469394360e3fb3d4357a0cfb586edef0d6b32e22dd4cab2b8e4ccbf386950151aaeb
-
C:\Users\Admin\AppData\Local\Temp\yjcltbhjqb.preFilesize
105KB
MD598c82c84e321b228d9f4134805727dce
SHA19cf96f5f939db05e4aa9eb56852698c4ecfc5e0e
SHA25645a50023994263d1b4b5b3eacf5402d5582353e31026733564ba35d2cb72e919
SHA512470f64d46ebc8501582ff2d1bc60603a082129df52de0e7607ed5845f157469394360e3fb3d4357a0cfb586edef0d6b32e22dd4cab2b8e4ccbf386950151aaeb
-
memory/948-144-0x0000000000400000-0x000000000044B520-memory.dmpFilesize
301KB
-
memory/948-138-0x0000000000000000-mapping.dmp
-
memory/948-143-0x00000000004A0000-0x00000000004A3000-memory.dmpFilesize
12KB
-
memory/948-142-0x00000000004A0000-0x00000000004A3000-memory.dmpFilesize
12KB
-
memory/2044-147-0x000000007F490000-0x000000007F4B0000-memory.dmpFilesize
128KB
-
memory/2044-146-0x000000007F490000-0x000000007F4B0000-memory.dmpFilesize
128KB
-
memory/2044-145-0x0000000000000000-mapping.dmp
-
memory/4656-132-0x00000000005A0000-0x00000000005A3000-memory.dmpFilesize
12KB
-
memory/4656-133-0x00000000005A0000-0x00000000005A3000-memory.dmpFilesize
12KB
-
memory/4656-134-0x0000000000400000-0x000000000044B520-memory.dmpFilesize
301KB
-
memory/4656-136-0x00000000005A0000-0x00000000005A3000-memory.dmpFilesize
12KB
-
memory/4920-135-0x0000000000000000-mapping.dmp
-
memory/4920-140-0x000000007FD10000-0x000000007FD30000-memory.dmpFilesize
128KB
-
memory/4920-137-0x000000007FD10000-0x000000007FD30000-memory.dmpFilesize
128KB