5f202c5cd602839ffebf3ab1b308ddebc14f1fa8a3edd9e7876bfb5d057658dc

Analysis

max time kernel
124s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2023, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.exe
Size

8.1MB
MD5

c3c2f4e4420c75c69a5033cc64947d51
SHA1

4b0010618c908b897d657147ad9b21a646ddde32
SHA256

5f202c5cd602839ffebf3ab1b308ddebc14f1fa8a3edd9e7876bfb5d057658dc
SHA512

21c4df6a73808bb809d3c1dc83feb738161929ae76d863c1de1e96cbbbe21f92b347bf0b533b5f964ba2b2639d9d1f14f7553288d4294f30b5b667a83864cb07
SSDEEP

196608:U38JJEU16hTZl583S0LJu+mzfDkzUoXOM1ught7SV:V1MlCC0Ybzf4zUoXN8AW

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5024	Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.tmp

Loads dropped DLL 3 IoCs

pid	Process
5024	Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.tmp
5024	Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.tmp
5024	Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.tmp

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 5024	1944	Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.exe	82
PID 1944 wrote to memory of 5024	1944	Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.exe	82
PID 1944 wrote to memory of 5024	1944	Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.exe	82

C:\Users\Admin\AppData\Local\Temp\Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.exe
"C:\Users\Admin\AppData\Local\Temp\Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\is-39DCR.tmp\Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-39DCR.tmp\Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.tmp" /SL5="$E006C,7540986,1235456,C:\Users\Admin\AppData\Local\Temp\Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:5024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-39DCR.tmp\Virtyu Ghost Client - Linkvertise Downloader_A2x-SC1.tmp

Filesize
3.4MB

MD5
5e99bb58ef7c6511011212dcc2d7c54e

SHA1
8903f713ce95672cb10d6a6052173a60f87a8073

SHA256
b4a2171728f8801e9de60ccece4d9c02796c0b43249868ec571b1fb16d18a929

SHA512
21f484df6b1141f23863a71548e49a6af4af32008a1ba4664965b5a05ad7e1d934bd9ec97f8d7968d966d779612919ecf4639edfe4fe38723a688d2de1285be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K87SC.tmp\AppUtils.dll

Filesize
1.8MB

MD5
43ce6d593abd5141a3139603f352ae05

SHA1
a97c75e23d275dddfde15ef5fdf3ff3253c0992c

SHA256
94e874f2702ea6be50e7d74864b66e7f763449c3db237803f3fad6adfd64ed3d

SHA512
bfc527529e5f73ba190dfc5bd043175c7e2ae963b665d6d39421c29e025020f1d593dc88b7bee33d86ef6b4f7a4c5e1a0339df4e99cab6849a275d1dda9f439f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K87SC.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K87SC.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
memory/1944-132-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/1944-136-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/1944-141-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/5024-140-0x0000000005680000-0x000000000568F000-memory.dmp

Filesize
60KB

Download