d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6

Analysis

max time kernel
108s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe
Size

5.1MB
MD5

811f4faf0423cb1f853185cede912b1a
SHA1

250ba9119da15253f2288ef008545574bde48150
SHA256

d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6
SHA512

87cfe208120c53a15cfa2617821b1013323392158f94a9f7b1b457ae023efbfbd0f78331daff50066f25aac631b8feaabb091ed273623e51e81bd564e2fbe075
SSDEEP

98304:dQaElYj1yRAkBgWsopC8X95avLlrWvGYSQqhn07/Fa6eq+pKktjpqDqLAHd0g2dp:OFghPAEhYhydQ8KW65y16bfGVxNnoU9q

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Wine	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe

Loads dropped DLL 1 IoCs

pid	Process
3096	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3096	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3096	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe
3096	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe
3096	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe
3096	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe

C:\Users\Admin\AppData\Local\Temp\d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe
"C:\Users\Admin\AppData\Local\Temp\d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5e8254a0-4dde-4c48-bfb1-5ff4ac254f29\CliSecureRT.dll

Filesize
1.5MB

MD5
a5742879630b4e0677727c7eddd63758

SHA1
a5e3e05876a960258144b55ed2dab167f15cc9ae

SHA256
eef673a6f52b41a2cf69d67b34fc38256fbad0b4838b1e2fcca8543638f0a3b0

SHA512
ad4b5d7b8bce97acb3d2b839b8b8c24124367079a6824ae66da4122d55f3ef0d5e41ab5aa8ec58f3a7c807914ee2c1096f53665b4a37cc508a3875fb1bf71edd

Download Submit
memory/3096-132-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/3096-135-0x0000000005FE0000-0x00000000060D5000-memory.dmp

Filesize
980KB

Download
memory/3096-134-0x00000000735C0000-0x00000000738D2000-memory.dmp

Filesize
3.1MB

Download
memory/3096-136-0x00000000740C0000-0x000000007411B000-memory.dmp

Filesize
364KB

Download
memory/3096-137-0x0000000077C50000-0x0000000077DF3000-memory.dmp

Filesize
1.6MB

Download
memory/3096-138-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/3096-139-0x00000000735C0000-0x00000000738D2000-memory.dmp

Filesize
3.1MB

Download
memory/3096-140-0x0000000077C50000-0x0000000077DF3000-memory.dmp

Filesize
1.6MB

Download