Analysis
-
max time kernel
185s -
max time network
193s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 07:58
Behavioral task
behavioral1
Sample
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe
Resource
win7-20221111-en
General
-
Target
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe
-
Size
8.7MB
-
MD5
2f56038a57495ab5608e1c67f7dbd688
-
SHA1
4da970efac6083ea26971c319671bcc2d6efd71a
-
SHA256
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0
-
SHA512
12f1774ce6371fe1bcbee92107c46823694416e98068083e4d38c5a3381a4ca07b6d0895c6c09fb1c590fc20d9ed1e9928cedb6e0608a91c3addb4c9eee7520a
-
SSDEEP
196608:dDUIKAOLfrO/vgf8s3YLo71iEHj9kZVz/RV:dAIKRjrO/aILU1J9kx
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
Processes:
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exeivm31_protected.exeivm32_protected.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ivm31_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ivm32_protected.exe -
Executes dropped EXE 2 IoCs
Processes:
ivm31_protected.exeivm32_protected.exepid process 1112 ivm31_protected.exe 1792 ivm32_protected.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exeivm31_protected.exeivm32_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ivm31_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ivm31_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ivm32_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ivm32_protected.exe -
Loads dropped DLL 2 IoCs
Processes:
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exepid process 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/992-54-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral1/memory/992-56-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral1/memory/992-57-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral1/memory/992-58-0x0000000000400000-0x0000000001148000-memory.dmp themida \ProgramData\Gds\ivm31_protected.exe themida behavioral1/memory/992-62-0x0000000000400000-0x0000000001148000-memory.dmp themida C:\ProgramData\Gds\ivm31_protected.exe themida behavioral1/memory/1112-67-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral1/memory/1112-68-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral1/memory/1112-69-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral1/memory/1112-70-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral1/memory/1112-71-0x0000000077D80000-0x0000000077F00000-memory.dmp themida \ProgramData\Gds\ivm32_protected.exe themida C:\ProgramData\Gds\ivm32_protected.exe themida behavioral1/memory/1792-78-0x00000000002C0000-0x0000000000A39000-memory.dmp themida behavioral1/memory/1792-79-0x00000000002C0000-0x0000000000A39000-memory.dmp themida behavioral1/memory/1792-80-0x00000000002C0000-0x0000000000A39000-memory.dmp themida behavioral1/memory/1792-81-0x00000000002C0000-0x0000000000A39000-memory.dmp themida behavioral1/memory/1792-82-0x00000000002C0000-0x0000000000A39000-memory.dmp themida behavioral1/memory/1792-83-0x00000000002C0000-0x0000000000A39000-memory.dmp themida behavioral1/memory/1792-84-0x00000000002C0000-0x0000000000A39000-memory.dmp themida behavioral1/memory/1792-85-0x00000000002C0000-0x0000000000A39000-memory.dmp themida behavioral1/memory/1792-86-0x00000000002C0000-0x0000000000A39000-memory.dmp themida behavioral1/memory/1112-88-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral1/memory/1792-93-0x00000000002C0000-0x0000000000A39000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exeivm31_protected.exeivm32_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ivm31_protected.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ivm32_protected.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exeivm31_protected.exeivm32_protected.exepid process 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe 1112 ivm31_protected.exe 1792 ivm32_protected.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ivm32_protected.exeivm31_protected.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ivm32_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ivm32_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ivm31_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ivm31_protected.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
Processes:
ivm32_protected.exeivm31_protected.exepid process 1792 ivm32_protected.exe 1792 ivm32_protected.exe 1792 ivm32_protected.exe 1792 ivm32_protected.exe 1792 ivm32_protected.exe 1792 ivm32_protected.exe 1792 ivm32_protected.exe 1112 ivm31_protected.exe 1792 ivm32_protected.exe 1792 ivm32_protected.exe 1792 ivm32_protected.exe 1792 ivm32_protected.exe 1792 ivm32_protected.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exedescription pid process target process PID 992 wrote to memory of 1112 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm31_protected.exe PID 992 wrote to memory of 1112 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm31_protected.exe PID 992 wrote to memory of 1112 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm31_protected.exe PID 992 wrote to memory of 1112 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm31_protected.exe PID 992 wrote to memory of 1112 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm31_protected.exe PID 992 wrote to memory of 1112 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm31_protected.exe PID 992 wrote to memory of 1112 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm31_protected.exe PID 992 wrote to memory of 1792 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm32_protected.exe PID 992 wrote to memory of 1792 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm32_protected.exe PID 992 wrote to memory of 1792 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm32_protected.exe PID 992 wrote to memory of 1792 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm32_protected.exe PID 992 wrote to memory of 1792 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm32_protected.exe PID 992 wrote to memory of 1792 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm32_protected.exe PID 992 wrote to memory of 1792 992 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm32_protected.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe"C:\Users\Admin\AppData\Local\Temp\6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Gds\ivm31_protected.exeC:\ProgramData\Gds\ivm31_protected.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Gds\ivm32_protected.exeC:\ProgramData\Gds\ivm32_protected.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Gds\ivm31_protected.exeFilesize
2.8MB
MD52093bf0de6bc1a8763835f287b8784dc
SHA1a15bd81406d950f86120ae338125beb8e85923c4
SHA2560a429c131f5188ad77d4f453e5dbeca5f0e451c4dab3789fd2dce9467ba90b42
SHA512c86476e9c764921295eeed033217bf5e73cf508606b6f32968381da004828605dfb4c589abb712f46aa8b7648700bcdfa6699fdaf1d197c0d13ab68600213ed3
-
C:\ProgramData\Gds\ivm32_protected.exeFilesize
3.0MB
MD5d061734e588fd7fdc40c6eb4dece2dbf
SHA1ff303916430955881bfc28b3f3ec7f237edd6c88
SHA25614a8f6dd57824fc552daddc145bc7492427fbde9ca3b96c1040f3d296e34921c
SHA512115d7824fa0eca30804bfc37b249f2d7b1b2b0424bb81fa8c2c2170de12ef80e28686b9a74a728760f14321d99d6b67b17b13926891f419b09ec8a16cf9ddc17
-
\ProgramData\Gds\ivm31_protected.exeFilesize
2.8MB
MD52093bf0de6bc1a8763835f287b8784dc
SHA1a15bd81406d950f86120ae338125beb8e85923c4
SHA2560a429c131f5188ad77d4f453e5dbeca5f0e451c4dab3789fd2dce9467ba90b42
SHA512c86476e9c764921295eeed033217bf5e73cf508606b6f32968381da004828605dfb4c589abb712f46aa8b7648700bcdfa6699fdaf1d197c0d13ab68600213ed3
-
\ProgramData\Gds\ivm32_protected.exeFilesize
3.0MB
MD5d061734e588fd7fdc40c6eb4dece2dbf
SHA1ff303916430955881bfc28b3f3ec7f237edd6c88
SHA25614a8f6dd57824fc552daddc145bc7492427fbde9ca3b96c1040f3d296e34921c
SHA512115d7824fa0eca30804bfc37b249f2d7b1b2b0424bb81fa8c2c2170de12ef80e28686b9a74a728760f14321d99d6b67b17b13926891f419b09ec8a16cf9ddc17
-
memory/992-62-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/992-59-0x0000000077D80000-0x0000000077F00000-memory.dmpFilesize
1.5MB
-
memory/992-58-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/992-61-0x0000000004190000-0x0000000004887000-memory.dmpFilesize
7.0MB
-
memory/992-72-0x0000000004190000-0x0000000004887000-memory.dmpFilesize
7.0MB
-
memory/992-63-0x0000000077D80000-0x0000000077F00000-memory.dmpFilesize
1.5MB
-
memory/992-54-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/992-57-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/992-92-0x0000000004190000-0x0000000004909000-memory.dmpFilesize
7.5MB
-
memory/992-77-0x0000000004190000-0x0000000004909000-memory.dmpFilesize
7.5MB
-
memory/992-56-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/992-55-0x00000000767D1000-0x00000000767D3000-memory.dmpFilesize
8KB
-
memory/1112-64-0x0000000000000000-mapping.dmp
-
memory/1112-88-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/1112-70-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/1112-99-0x00000000747A1000-0x00000000747A3000-memory.dmpFilesize
8KB
-
memory/1112-69-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/1112-68-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/1112-71-0x0000000077D80000-0x0000000077F00000-memory.dmpFilesize
1.5MB
-
memory/1112-67-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/1112-89-0x0000000077D80000-0x0000000077F00000-memory.dmpFilesize
1.5MB
-
memory/1792-78-0x00000000002C0000-0x0000000000A39000-memory.dmpFilesize
7.5MB
-
memory/1792-81-0x00000000002C0000-0x0000000000A39000-memory.dmpFilesize
7.5MB
-
memory/1792-83-0x00000000002C0000-0x0000000000A39000-memory.dmpFilesize
7.5MB
-
memory/1792-84-0x00000000002C0000-0x0000000000A39000-memory.dmpFilesize
7.5MB
-
memory/1792-85-0x00000000002C0000-0x0000000000A39000-memory.dmpFilesize
7.5MB
-
memory/1792-86-0x00000000002C0000-0x0000000000A39000-memory.dmpFilesize
7.5MB
-
memory/1792-87-0x0000000077D80000-0x0000000077F00000-memory.dmpFilesize
1.5MB
-
memory/1792-82-0x00000000002C0000-0x0000000000A39000-memory.dmpFilesize
7.5MB
-
memory/1792-80-0x00000000002C0000-0x0000000000A39000-memory.dmpFilesize
7.5MB
-
memory/1792-90-0x0000000074AD1000-0x0000000074AD3000-memory.dmpFilesize
8KB
-
memory/1792-91-0x0000000074911000-0x0000000074913000-memory.dmpFilesize
8KB
-
memory/1792-79-0x00000000002C0000-0x0000000000A39000-memory.dmpFilesize
7.5MB
-
memory/1792-93-0x00000000002C0000-0x0000000000A39000-memory.dmpFilesize
7.5MB
-
memory/1792-97-0x0000000077D80000-0x0000000077F00000-memory.dmpFilesize
1.5MB
-
memory/1792-74-0x0000000000000000-mapping.dmp