Analysis
-
max time kernel
69s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe
-
Size
897KB
-
MD5
8c0de0256142e6c494b02630cdf0b667
-
SHA1
91c6377097f4681d7b1f1a5dfce1a95865f30324
-
SHA256
744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb
-
SHA512
781cda77d387c5c55291d55a8ae9e49560d4ec0006e3c02b7e4fdb9ca674e2546be395256afef76dd603457a18dd741afbc83045ecabd2a181a9720394f23646
-
SSDEEP
24576:o5f0X77Gu9o9UpgWoaYQ/ObNshEOQJ+riG:u1u9fvPYSGN6ErJq
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ apocalyps32.exe -
Executes dropped EXE 1 IoCs
pid Process 4376 apocalyps32.exe -
resource yara_rule behavioral2/memory/4376-143-0x0000000040010000-0x000000004004C000-memory.dmp upx -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Wine 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Wine apocalyps32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1752 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe 4376 apocalyps32.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\apocalyps32.exe 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe File opened for modification C:\Windows\apocalyps32.exe 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe File created C:\Windows\apocalyps32.exe apocalyps32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1752 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe 1752 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe 4376 apocalyps32.exe 4376 apocalyps32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 4376 1752 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe 80 PID 1752 wrote to memory of 4376 1752 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe 80 PID 1752 wrote to memory of 4376 1752 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe 80 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81 PID 4376 wrote to memory of 1284 4376 apocalyps32.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe"C:\Users\Admin\AppData\Local\Temp\744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\apocalyps32.exe-bs2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:1284
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
897KB
MD58c0de0256142e6c494b02630cdf0b667
SHA191c6377097f4681d7b1f1a5dfce1a95865f30324
SHA256744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb
SHA512781cda77d387c5c55291d55a8ae9e49560d4ec0006e3c02b7e4fdb9ca674e2546be395256afef76dd603457a18dd741afbc83045ecabd2a181a9720394f23646
-
Filesize
897KB
MD58c0de0256142e6c494b02630cdf0b667
SHA191c6377097f4681d7b1f1a5dfce1a95865f30324
SHA256744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb
SHA512781cda77d387c5c55291d55a8ae9e49560d4ec0006e3c02b7e4fdb9ca674e2546be395256afef76dd603457a18dd741afbc83045ecabd2a181a9720394f23646