laplas | e433512ad2b47afbc778ab161a218944b504c90f513ff320d2aa8bfc55d5cb25

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	71050189784167328595.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sRrfjeBGVm.exe

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
3652	71050189784167328595.exe
956	22423491822522454655.exe
4592	sRrfjeBGVm.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	71050189784167328595.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	71050189784167328595.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sRrfjeBGVm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sRrfjeBGVm.exe

Loads dropped DLL 2 IoCs

pid	Process
4856	InstallUtil.exe
4856	InstallUtil.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 14 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000200000001e7cf-163.dat	themida
behavioral2/files/0x000200000001e7cf-164.dat	themida
behavioral2/memory/3652-165-0x0000000000710000-0x0000000000F03000-memory.dmp	themida
behavioral2/memory/3652-166-0x0000000000710000-0x0000000000F03000-memory.dmp	themida
behavioral2/memory/3652-167-0x0000000000710000-0x0000000000F03000-memory.dmp	themida
behavioral2/memory/3652-168-0x0000000000710000-0x0000000000F03000-memory.dmp	themida
behavioral2/memory/3652-189-0x0000000000710000-0x0000000000F03000-memory.dmp	themida
behavioral2/files/0x0002000000022b2b-191.dat	themida
behavioral2/files/0x0002000000022b2b-190.dat	themida
behavioral2/memory/4592-192-0x00000000008C0000-0x00000000010B3000-memory.dmp	themida
behavioral2/memory/4592-193-0x00000000008C0000-0x00000000010B3000-memory.dmp	themida
behavioral2/memory/4592-194-0x00000000008C0000-0x00000000010B3000-memory.dmp	themida
behavioral2/memory/4592-195-0x00000000008C0000-0x00000000010B3000-memory.dmp	themida
behavioral2/memory/4592-196-0x00000000008C0000-0x00000000010B3000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sRrfjeBGVm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	71050189784167328595.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4112 set thread context of 4856	4112	Setup.exe	82

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallUtil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallUtil.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
608	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4644	timeout.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	42	Go-http-client/1.1
HTTP User-Agent header	47	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4856	InstallUtil.exe
4856	InstallUtil.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4856	4112	Setup.exe	82
PID 4112 wrote to memory of 4856	4112	Setup.exe	82
PID 4112 wrote to memory of 4856	4112	Setup.exe	82
PID 4112 wrote to memory of 4856	4112	Setup.exe	82
PID 4112 wrote to memory of 4856	4112	Setup.exe	82
PID 4112 wrote to memory of 4856	4112	Setup.exe	82
PID 4112 wrote to memory of 4856	4112	Setup.exe	82
PID 4112 wrote to memory of 4856	4112	Setup.exe	82
PID 4112 wrote to memory of 4856	4112	Setup.exe	82
PID 4856 wrote to memory of 3652	4856	InstallUtil.exe	90
PID 4856 wrote to memory of 3652	4856	InstallUtil.exe	90
PID 4856 wrote to memory of 3652	4856	InstallUtil.exe	90
PID 4856 wrote to memory of 956	4856	InstallUtil.exe	92
PID 4856 wrote to memory of 956	4856	InstallUtil.exe	92
PID 956 wrote to memory of 3216	956	22423491822522454655.exe	93
PID 956 wrote to memory of 3216	956	22423491822522454655.exe	93
PID 3216 wrote to memory of 4628	3216	cmd.exe	95
PID 3216 wrote to memory of 4628	3216	cmd.exe	95
PID 4856 wrote to memory of 856	4856	InstallUtil.exe	97
PID 4856 wrote to memory of 856	4856	InstallUtil.exe	97
PID 4856 wrote to memory of 856	4856	InstallUtil.exe	97
PID 856 wrote to memory of 4644	856	cmd.exe	99
PID 856 wrote to memory of 4644	856	cmd.exe	99
PID 856 wrote to memory of 4644	856	cmd.exe	99
PID 3652 wrote to memory of 1272	3652	71050189784167328595.exe	100
PID 3652 wrote to memory of 1272	3652	71050189784167328595.exe	100
PID 3652 wrote to memory of 1272	3652	71050189784167328595.exe	100
PID 1272 wrote to memory of 608	1272	cmd.exe	102
PID 1272 wrote to memory of 608	1272	cmd.exe	102
PID 1272 wrote to memory of 608	1272	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\ProgramData\71050189784167328595.exe
    "C:\ProgramData\71050189784167328595.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C schtasks /create /tn mDHCkATZaI /tr C:\Users\Admin\AppData\Roaming\mDHCkATZaI\sRrfjeBGVm.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1272
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn mDHCkATZaI /tr C:\Users\Admin\AppData\Roaming\mDHCkATZaI\sRrfjeBGVm.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Creates scheduled task(s)
        
        PID:608
- - C:\ProgramData\22423491822522454655.exe
    "C:\ProgramData\22423491822522454655.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\22423491822522454655.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3216
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 0
        5⤵
        
        PID:4628
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:4644

C:\Users\Admin\AppData\Roaming\mDHCkATZaI\sRrfjeBGVm.exe
C:\Users\Admin\AppData\Roaming\mDHCkATZaI\sRrfjeBGVm.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:4592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery