Analysis
-
max time kernel
163s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 07:58
Behavioral task
behavioral1
Sample
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe
Resource
win7-20221111-en
General
-
Target
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe
-
Size
8.7MB
-
MD5
2f56038a57495ab5608e1c67f7dbd688
-
SHA1
4da970efac6083ea26971c319671bcc2d6efd71a
-
SHA256
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0
-
SHA512
12f1774ce6371fe1bcbee92107c46823694416e98068083e4d38c5a3381a4ca07b6d0895c6c09fb1c590fc20d9ed1e9928cedb6e0608a91c3addb4c9eee7520a
-
SSDEEP
196608:dDUIKAOLfrO/vgf8s3YLo71iEHj9kZVz/RV:dAIKRjrO/aILU1J9kx
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
Processes:
ivm31_protected.exeivm32_protected.exe6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ivm31_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ivm32_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe -
Executes dropped EXE 2 IoCs
Processes:
ivm31_protected.exeivm32_protected.exepid process 4604 ivm31_protected.exe 4704 ivm32_protected.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ivm32_protected.exe6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exeivm31_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ivm32_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ivm32_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ivm31_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ivm31_protected.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4072-132-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral2/memory/4072-133-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral2/memory/4072-134-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral2/memory/4072-135-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral2/memory/4072-137-0x0000000000400000-0x0000000001148000-memory.dmp themida C:\ProgramData\Gds\ivm31_protected.exe themida C:\ProgramData\Gds\ivm31_protected.exe themida behavioral2/memory/4604-141-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral2/memory/4604-142-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral2/memory/4604-143-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral2/memory/4604-144-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral2/memory/4604-146-0x0000000000400000-0x0000000000AF7000-memory.dmp themida C:\ProgramData\Gds\ivm32_protected.exe themida C:\ProgramData\Gds\ivm32_protected.exe themida behavioral2/memory/4704-150-0x0000000000360000-0x0000000000AD9000-memory.dmp themida behavioral2/memory/4704-151-0x0000000000360000-0x0000000000AD9000-memory.dmp themida behavioral2/memory/4704-152-0x0000000000360000-0x0000000000AD9000-memory.dmp themida behavioral2/memory/4704-153-0x0000000000360000-0x0000000000AD9000-memory.dmp themida behavioral2/memory/4704-154-0x0000000000360000-0x0000000000AD9000-memory.dmp themida behavioral2/memory/4604-156-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral2/memory/4704-157-0x0000000000360000-0x0000000000AD9000-memory.dmp themida behavioral2/memory/4704-159-0x0000000000360000-0x0000000000AD9000-memory.dmp themida behavioral2/memory/4704-160-0x0000000000360000-0x0000000000AD9000-memory.dmp themida behavioral2/memory/4704-161-0x0000000000360000-0x0000000000AD9000-memory.dmp themida behavioral2/memory/4704-162-0x0000000000360000-0x0000000000AD9000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exeivm31_protected.exeivm32_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ivm31_protected.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ivm32_protected.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 62 ip-api.com 68 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exeivm31_protected.exeivm32_protected.exepid process 4072 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe 4604 ivm31_protected.exe 4704 ivm32_protected.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ivm32_protected.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ivm32_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ivm32_protected.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
Processes:
ivm32_protected.exepid process 4704 ivm32_protected.exe 4704 ivm32_protected.exe 4704 ivm32_protected.exe 4704 ivm32_protected.exe 4704 ivm32_protected.exe 4704 ivm32_protected.exe 4704 ivm32_protected.exe 4704 ivm32_protected.exe 4704 ivm32_protected.exe 4704 ivm32_protected.exe 4704 ivm32_protected.exe 4704 ivm32_protected.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exedescription pid process target process PID 4072 wrote to memory of 4604 4072 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm31_protected.exe PID 4072 wrote to memory of 4604 4072 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm31_protected.exe PID 4072 wrote to memory of 4604 4072 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm31_protected.exe PID 4072 wrote to memory of 4704 4072 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm32_protected.exe PID 4072 wrote to memory of 4704 4072 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm32_protected.exe PID 4072 wrote to memory of 4704 4072 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe ivm32_protected.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe"C:\Users\Admin\AppData\Local\Temp\6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Gds\ivm31_protected.exeC:\ProgramData\Gds\ivm31_protected.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\Gds\ivm32_protected.exeC:\ProgramData\Gds\ivm32_protected.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Gds\ivm31_protected.exeFilesize
2.8MB
MD52093bf0de6bc1a8763835f287b8784dc
SHA1a15bd81406d950f86120ae338125beb8e85923c4
SHA2560a429c131f5188ad77d4f453e5dbeca5f0e451c4dab3789fd2dce9467ba90b42
SHA512c86476e9c764921295eeed033217bf5e73cf508606b6f32968381da004828605dfb4c589abb712f46aa8b7648700bcdfa6699fdaf1d197c0d13ab68600213ed3
-
C:\ProgramData\Gds\ivm31_protected.exeFilesize
2.8MB
MD52093bf0de6bc1a8763835f287b8784dc
SHA1a15bd81406d950f86120ae338125beb8e85923c4
SHA2560a429c131f5188ad77d4f453e5dbeca5f0e451c4dab3789fd2dce9467ba90b42
SHA512c86476e9c764921295eeed033217bf5e73cf508606b6f32968381da004828605dfb4c589abb712f46aa8b7648700bcdfa6699fdaf1d197c0d13ab68600213ed3
-
C:\ProgramData\Gds\ivm32_protected.exeFilesize
3.0MB
MD5d061734e588fd7fdc40c6eb4dece2dbf
SHA1ff303916430955881bfc28b3f3ec7f237edd6c88
SHA25614a8f6dd57824fc552daddc145bc7492427fbde9ca3b96c1040f3d296e34921c
SHA512115d7824fa0eca30804bfc37b249f2d7b1b2b0424bb81fa8c2c2170de12ef80e28686b9a74a728760f14321d99d6b67b17b13926891f419b09ec8a16cf9ddc17
-
C:\ProgramData\Gds\ivm32_protected.exeFilesize
3.0MB
MD5d061734e588fd7fdc40c6eb4dece2dbf
SHA1ff303916430955881bfc28b3f3ec7f237edd6c88
SHA25614a8f6dd57824fc552daddc145bc7492427fbde9ca3b96c1040f3d296e34921c
SHA512115d7824fa0eca30804bfc37b249f2d7b1b2b0424bb81fa8c2c2170de12ef80e28686b9a74a728760f14321d99d6b67b17b13926891f419b09ec8a16cf9ddc17
-
memory/4072-135-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/4072-137-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/4072-132-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/4072-134-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/4072-133-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/4072-136-0x0000000076FC0000-0x0000000077163000-memory.dmpFilesize
1.6MB
-
memory/4604-142-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4604-156-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4604-144-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4604-145-0x0000000076FC0000-0x0000000077163000-memory.dmpFilesize
1.6MB
-
memory/4604-146-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4604-138-0x0000000000000000-mapping.dmp
-
memory/4604-143-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4604-141-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4604-158-0x0000000076FC0000-0x0000000077163000-memory.dmpFilesize
1.6MB
-
memory/4704-163-0x0000000076FC0000-0x0000000077163000-memory.dmpFilesize
1.6MB
-
memory/4704-152-0x0000000000360000-0x0000000000AD9000-memory.dmpFilesize
7.5MB
-
memory/4704-153-0x0000000000360000-0x0000000000AD9000-memory.dmpFilesize
7.5MB
-
memory/4704-154-0x0000000000360000-0x0000000000AD9000-memory.dmpFilesize
7.5MB
-
memory/4704-155-0x0000000076FC0000-0x0000000077163000-memory.dmpFilesize
1.6MB
-
memory/4704-151-0x0000000000360000-0x0000000000AD9000-memory.dmpFilesize
7.5MB
-
memory/4704-157-0x0000000000360000-0x0000000000AD9000-memory.dmpFilesize
7.5MB
-
memory/4704-150-0x0000000000360000-0x0000000000AD9000-memory.dmpFilesize
7.5MB
-
memory/4704-159-0x0000000000360000-0x0000000000AD9000-memory.dmpFilesize
7.5MB
-
memory/4704-160-0x0000000000360000-0x0000000000AD9000-memory.dmpFilesize
7.5MB
-
memory/4704-161-0x0000000000360000-0x0000000000AD9000-memory.dmpFilesize
7.5MB
-
memory/4704-162-0x0000000000360000-0x0000000000AD9000-memory.dmpFilesize
7.5MB
-
memory/4704-147-0x0000000000000000-mapping.dmp