bd0488bd8c388dd8f1055b7429a0b406d29a8d0f6c44e710c8887b48e1828b65

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd0488bd8c388dd8f1055b7429a0b406d29a8d0f6c44e710c8887b48e1828b65.dll
Size

727KB
MD5

0e6e52ae9d922ec2377740e2d9d7f72e
SHA1

d5dca59868769dd61510af646e41aa830536096a
SHA256

bd0488bd8c388dd8f1055b7429a0b406d29a8d0f6c44e710c8887b48e1828b65
SHA512

1eb2805b0a7c4d5c7889026bd21523c562c4b50f24ff1f45fc41255cda8416ca2d67f4125e5a541034c0a8fd413ad82f9c2e27054ea3d657a7d9308f72ed0253
SSDEEP

12288:QoqZ0FV03nIjupZm3B21tiWWx0OSa5/4b8EO0y8YMoqxyuuOglaBVuMZ2Ze05k:UIjMEI1tiVSOl5/4gEYjqzIaBsM0

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	regsvr32.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Wine	regsvr32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4644	regsvr32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	4644	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4644	regsvr32.exe
4644	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4644	4836	regsvr32.exe	81
PID 4836 wrote to memory of 4644	4836	regsvr32.exe	81
PID 4836 wrote to memory of 4644	4836	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bd0488bd8c388dd8f1055b7429a0b406d29a8d0f6c44e710c8887b48e1828b65.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bd0488bd8c388dd8f1055b7429a0b406d29a8d0f6c44e710c8887b48e1828b65.dll
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 828
    3⤵
    - Program crash
    PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4644 -ip 4644
1⤵
PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4644-136-0x0000000002470000-0x000000000260E000-memory.dmp

Filesize
1.6MB

Download
memory/4644-137-0x0000000002470000-0x000000000260E000-memory.dmp

Filesize
1.6MB

Download
memory/4644-138-0x00000000022D0000-0x000000000236D000-memory.dmp

Filesize
628KB

Download
memory/4644-139-0x0000000077990000-0x0000000077B33000-memory.dmp

Filesize
1.6MB

Download
memory/4644-140-0x0000000002470000-0x000000000260E000-memory.dmp

Filesize
1.6MB

Download
memory/4644-141-0x0000000002470000-0x000000000260E000-memory.dmp

Filesize
1.6MB

Download
memory/4644-142-0x0000000077990000-0x0000000077B33000-memory.dmp

Filesize
1.6MB

Download