Analysis
-
max time kernel
156s -
max time network
176s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 06:18
Behavioral task
behavioral1
Sample
2f56038a57495ab5608e1c67f7dbd688.bin.exe
Resource
win7-20220812-en
General
-
Target
2f56038a57495ab5608e1c67f7dbd688.bin.exe
-
Size
8.7MB
-
MD5
2f56038a57495ab5608e1c67f7dbd688
-
SHA1
4da970efac6083ea26971c319671bcc2d6efd71a
-
SHA256
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0
-
SHA512
12f1774ce6371fe1bcbee92107c46823694416e98068083e4d38c5a3381a4ca07b6d0895c6c09fb1c590fc20d9ed1e9928cedb6e0608a91c3addb4c9eee7520a
-
SSDEEP
196608:dDUIKAOLfrO/vgf8s3YLo71iEHj9kZVz/RV:dAIKRjrO/aILU1J9kx
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
Processes:
2f56038a57495ab5608e1c67f7dbd688.bin.exeivm31_protected.exeivm32_protected.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2f56038a57495ab5608e1c67f7dbd688.bin.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ivm31_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ivm32_protected.exe -
Executes dropped EXE 2 IoCs
Processes:
ivm31_protected.exeivm32_protected.exepid process 1360 ivm31_protected.exe 1076 ivm32_protected.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2f56038a57495ab5608e1c67f7dbd688.bin.exeivm31_protected.exeivm32_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2f56038a57495ab5608e1c67f7dbd688.bin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2f56038a57495ab5608e1c67f7dbd688.bin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ivm31_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ivm31_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ivm32_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ivm32_protected.exe -
Loads dropped DLL 2 IoCs
Processes:
2f56038a57495ab5608e1c67f7dbd688.bin.exepid process 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1920-54-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral1/memory/1920-56-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral1/memory/1920-57-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral1/memory/1920-58-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral1/memory/1920-60-0x0000000000400000-0x0000000001148000-memory.dmp themida \ProgramData\Gds\ivm31_protected.exe themida C:\ProgramData\Gds\ivm31_protected.exe themida behavioral1/memory/1920-65-0x00000000040C0000-0x00000000047B7000-memory.dmp themida behavioral1/memory/1360-66-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral1/memory/1360-67-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral1/memory/1360-68-0x0000000000400000-0x0000000000AF7000-memory.dmp themida \ProgramData\Gds\ivm32_protected.exe themida behavioral1/memory/1360-70-0x0000000000400000-0x0000000000AF7000-memory.dmp themida C:\ProgramData\Gds\ivm32_protected.exe themida behavioral1/memory/1076-76-0x0000000000E40000-0x00000000015B9000-memory.dmp themida behavioral1/memory/1076-77-0x0000000000E40000-0x00000000015B9000-memory.dmp themida behavioral1/memory/1076-78-0x0000000000E40000-0x00000000015B9000-memory.dmp themida behavioral1/memory/1076-79-0x0000000000E40000-0x00000000015B9000-memory.dmp themida behavioral1/memory/1076-80-0x0000000000E40000-0x00000000015B9000-memory.dmp themida behavioral1/memory/1076-81-0x0000000000E40000-0x00000000015B9000-memory.dmp themida behavioral1/memory/1076-82-0x0000000000E40000-0x00000000015B9000-memory.dmp themida behavioral1/memory/1076-83-0x0000000000E40000-0x00000000015B9000-memory.dmp themida behavioral1/memory/1360-85-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral1/memory/1076-87-0x0000000000E40000-0x00000000015B9000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
2f56038a57495ab5608e1c67f7dbd688.bin.exeivm31_protected.exeivm32_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2f56038a57495ab5608e1c67f7dbd688.bin.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ivm31_protected.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ivm32_protected.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com 10 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
2f56038a57495ab5608e1c67f7dbd688.bin.exeivm31_protected.exeivm32_protected.exepid process 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe 1360 ivm31_protected.exe 1076 ivm32_protected.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ivm32_protected.exeivm31_protected.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ivm32_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ivm32_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ivm31_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ivm31_protected.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
Processes:
ivm31_protected.exeivm32_protected.exepid process 1360 ivm31_protected.exe 1076 ivm32_protected.exe 1076 ivm32_protected.exe 1076 ivm32_protected.exe 1076 ivm32_protected.exe 1076 ivm32_protected.exe 1076 ivm32_protected.exe 1076 ivm32_protected.exe 1076 ivm32_protected.exe 1076 ivm32_protected.exe 1076 ivm32_protected.exe 1076 ivm32_protected.exe 1076 ivm32_protected.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
2f56038a57495ab5608e1c67f7dbd688.bin.exedescription pid process target process PID 1920 wrote to memory of 1360 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm31_protected.exe PID 1920 wrote to memory of 1360 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm31_protected.exe PID 1920 wrote to memory of 1360 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm31_protected.exe PID 1920 wrote to memory of 1360 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm31_protected.exe PID 1920 wrote to memory of 1360 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm31_protected.exe PID 1920 wrote to memory of 1360 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm31_protected.exe PID 1920 wrote to memory of 1360 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm31_protected.exe PID 1920 wrote to memory of 1076 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm32_protected.exe PID 1920 wrote to memory of 1076 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm32_protected.exe PID 1920 wrote to memory of 1076 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm32_protected.exe PID 1920 wrote to memory of 1076 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm32_protected.exe PID 1920 wrote to memory of 1076 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm32_protected.exe PID 1920 wrote to memory of 1076 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm32_protected.exe PID 1920 wrote to memory of 1076 1920 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm32_protected.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f56038a57495ab5608e1c67f7dbd688.bin.exe"C:\Users\Admin\AppData\Local\Temp\2f56038a57495ab5608e1c67f7dbd688.bin.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Gds\ivm31_protected.exeC:\ProgramData\Gds\ivm31_protected.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Gds\ivm32_protected.exeC:\ProgramData\Gds\ivm32_protected.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Gds\ivm31_protected.exeFilesize
2.8MB
MD52093bf0de6bc1a8763835f287b8784dc
SHA1a15bd81406d950f86120ae338125beb8e85923c4
SHA2560a429c131f5188ad77d4f453e5dbeca5f0e451c4dab3789fd2dce9467ba90b42
SHA512c86476e9c764921295eeed033217bf5e73cf508606b6f32968381da004828605dfb4c589abb712f46aa8b7648700bcdfa6699fdaf1d197c0d13ab68600213ed3
-
C:\ProgramData\Gds\ivm32_protected.exeFilesize
3.0MB
MD5d061734e588fd7fdc40c6eb4dece2dbf
SHA1ff303916430955881bfc28b3f3ec7f237edd6c88
SHA25614a8f6dd57824fc552daddc145bc7492427fbde9ca3b96c1040f3d296e34921c
SHA512115d7824fa0eca30804bfc37b249f2d7b1b2b0424bb81fa8c2c2170de12ef80e28686b9a74a728760f14321d99d6b67b17b13926891f419b09ec8a16cf9ddc17
-
\ProgramData\Gds\ivm31_protected.exeFilesize
2.8MB
MD52093bf0de6bc1a8763835f287b8784dc
SHA1a15bd81406d950f86120ae338125beb8e85923c4
SHA2560a429c131f5188ad77d4f453e5dbeca5f0e451c4dab3789fd2dce9467ba90b42
SHA512c86476e9c764921295eeed033217bf5e73cf508606b6f32968381da004828605dfb4c589abb712f46aa8b7648700bcdfa6699fdaf1d197c0d13ab68600213ed3
-
\ProgramData\Gds\ivm32_protected.exeFilesize
3.0MB
MD5d061734e588fd7fdc40c6eb4dece2dbf
SHA1ff303916430955881bfc28b3f3ec7f237edd6c88
SHA25614a8f6dd57824fc552daddc145bc7492427fbde9ca3b96c1040f3d296e34921c
SHA512115d7824fa0eca30804bfc37b249f2d7b1b2b0424bb81fa8c2c2170de12ef80e28686b9a74a728760f14321d99d6b67b17b13926891f419b09ec8a16cf9ddc17
-
memory/1076-80-0x0000000000E40000-0x00000000015B9000-memory.dmpFilesize
7.5MB
-
memory/1076-71-0x0000000000000000-mapping.dmp
-
memory/1076-90-0x0000000073DC1000-0x0000000073DC3000-memory.dmpFilesize
8KB
-
memory/1076-88-0x0000000073F81000-0x0000000073F83000-memory.dmpFilesize
8KB
-
memory/1076-87-0x0000000000E40000-0x00000000015B9000-memory.dmpFilesize
7.5MB
-
memory/1076-83-0x0000000000E40000-0x00000000015B9000-memory.dmpFilesize
7.5MB
-
memory/1076-82-0x0000000000E40000-0x00000000015B9000-memory.dmpFilesize
7.5MB
-
memory/1076-81-0x0000000000E40000-0x00000000015B9000-memory.dmpFilesize
7.5MB
-
memory/1076-79-0x0000000000E40000-0x00000000015B9000-memory.dmpFilesize
7.5MB
-
memory/1076-78-0x0000000000E40000-0x00000000015B9000-memory.dmpFilesize
7.5MB
-
memory/1076-77-0x0000000000E40000-0x00000000015B9000-memory.dmpFilesize
7.5MB
-
memory/1076-76-0x0000000000E40000-0x00000000015B9000-memory.dmpFilesize
7.5MB
-
memory/1360-67-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/1360-85-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/1360-62-0x0000000000000000-mapping.dmp
-
memory/1360-70-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/1360-72-0x0000000077350000-0x00000000774D0000-memory.dmpFilesize
1.5MB
-
memory/1360-66-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/1360-68-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/1920-59-0x0000000077350000-0x00000000774D0000-memory.dmpFilesize
1.5MB
-
memory/1920-54-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/1920-56-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/1920-65-0x00000000040C0000-0x00000000047B7000-memory.dmpFilesize
7.0MB
-
memory/1920-57-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/1920-84-0x00000000040C0000-0x00000000047B7000-memory.dmpFilesize
7.0MB
-
memory/1920-55-0x0000000075E81000-0x0000000075E83000-memory.dmpFilesize
8KB
-
memory/1920-86-0x00000000040C0000-0x0000000004839000-memory.dmpFilesize
7.5MB
-
memory/1920-73-0x00000000040C0000-0x0000000004839000-memory.dmpFilesize
7.5MB
-
memory/1920-58-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/1920-60-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB