Analysis
- max time kernel
393s - max time network
556s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
29/01/2023, 10:31
Behavioral task
behavioral1
Sample
instal_win64.exe
Resource
win7-20221111-en
windows7-x64
13 signatures
150 seconds
General
- Target instal_win64.exe
- Size 470.1MB
- Sample230129-mkvp7ach4w
- SHA256 d93048041395745df497b1f797f389281d1932d3ed69189c05bb67733a52245c
- MD5 0b7423de8820c2667c1cf8b1fed78f92
- SHA1 1e3b7d005546e88abb4ada562a91e9644016db13
- SHA512 31cd4f7812c92415201185279536fcc10e395dbdd52d2f40296f6eaba8f49c9929ab64785fe2dc807e01bf0bab96a791dbb8c9d5ca5fe899e57a8324dae50255
- SSDEEP 49152:1JnORI02pXoY4ZQIPv4R6D0qXjBlPQIrwxnj4v0qzQSTqrJ6MXJyw7VY1d8wpI:1JUI02eQQmc0+Jr2nj4cqzQlX4w7Vudo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
aurora
C2
-
45.15.156.210:8081
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ instal_win64.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion instal_win64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion instal_win64.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4928-132-0x0000000000120000-0x0000000000A97000-memory.dmp themida behavioral2/memory/4928-134-0x0000000000120000-0x0000000000A97000-memory.dmp themida behavioral2/memory/4928-135-0x0000000000120000-0x0000000000A97000-memory.dmp themida behavioral2/memory/4928-136-0x0000000000120000-0x0000000000A97000-memory.dmp themida behavioral2/memory/4928-137-0x0000000000120000-0x0000000000A97000-memory.dmp themida behavioral2/memory/4928-138-0x0000000000120000-0x0000000000A97000-memory.dmp themida behavioral2/memory/4928-139-0x0000000000120000-0x0000000000A97000-memory.dmp themida behavioral2/memory/4928-140-0x0000000000120000-0x0000000000A97000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA instal_win64.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4928 instal_win64.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4928 instal_win64.exe 4928 instal_win64.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2436 wmic.exe Token: SeSecurityPrivilege 2436 wmic.exe Token: SeTakeOwnershipPrivilege 2436 wmic.exe Token: SeLoadDriverPrivilege 2436 wmic.exe Token: SeSystemProfilePrivilege 2436 wmic.exe Token: SeSystemtimePrivilege 2436 wmic.exe Token: SeProfSingleProcessPrivilege 2436 wmic.exe Token: SeIncBasePriorityPrivilege 2436 wmic.exe Token: SeCreatePagefilePrivilege 2436 wmic.exe Token: SeBackupPrivilege 2436 wmic.exe Token: SeRestorePrivilege 2436 wmic.exe Token: SeShutdownPrivilege 2436 wmic.exe Token: SeDebugPrivilege 2436 wmic.exe Token: SeSystemEnvironmentPrivilege 2436 wmic.exe Token: SeRemoteShutdownPrivilege 2436 wmic.exe Token: SeUndockPrivilege 2436 wmic.exe Token: SeManageVolumePrivilege 2436 wmic.exe Token: 33 2436 wmic.exe Token: 34 2436 wmic.exe Token: 35 2436 wmic.exe Token: 36 2436 wmic.exe Token: SeIncreaseQuotaPrivilege 2436 wmic.exe Token: SeSecurityPrivilege 2436 wmic.exe Token: SeTakeOwnershipPrivilege 2436 wmic.exe Token: SeLoadDriverPrivilege 2436 wmic.exe Token: SeSystemProfilePrivilege 2436 wmic.exe Token: SeSystemtimePrivilege 2436 wmic.exe Token: SeProfSingleProcessPrivilege 2436 wmic.exe Token: SeIncBasePriorityPrivilege 2436 wmic.exe Token: SeCreatePagefilePrivilege 2436 wmic.exe Token: SeBackupPrivilege 2436 wmic.exe Token: SeRestorePrivilege 2436 wmic.exe Token: SeShutdownPrivilege 2436 wmic.exe Token: SeDebugPrivilege 2436 wmic.exe Token: SeSystemEnvironmentPrivilege 2436 wmic.exe Token: SeRemoteShutdownPrivilege 2436 wmic.exe Token: SeUndockPrivilege 2436 wmic.exe Token: SeManageVolumePrivilege 2436 wmic.exe Token: 33 2436 wmic.exe Token: 34 2436 wmic.exe Token: 35 2436 wmic.exe Token: 36 2436 wmic.exe Token: SeIncreaseQuotaPrivilege 4940 WMIC.exe Token: SeSecurityPrivilege 4940 WMIC.exe Token: SeTakeOwnershipPrivilege 4940 WMIC.exe Token: SeLoadDriverPrivilege 4940 WMIC.exe Token: SeSystemProfilePrivilege 4940 WMIC.exe Token: SeSystemtimePrivilege 4940 WMIC.exe Token: SeProfSingleProcessPrivilege 4940 WMIC.exe Token: SeIncBasePriorityPrivilege 4940 WMIC.exe Token: SeCreatePagefilePrivilege 4940 WMIC.exe Token: SeBackupPrivilege 4940 WMIC.exe Token: SeRestorePrivilege 4940 WMIC.exe Token: SeShutdownPrivilege 4940 WMIC.exe Token: SeDebugPrivilege 4940 WMIC.exe Token: SeSystemEnvironmentPrivilege 4940 WMIC.exe Token: SeRemoteShutdownPrivilege 4940 WMIC.exe Token: SeUndockPrivilege 4940 WMIC.exe Token: SeManageVolumePrivilege 4940 WMIC.exe Token: 33 4940 WMIC.exe Token: 34 4940 WMIC.exe Token: 35 4940 WMIC.exe Token: 36 4940 WMIC.exe Token: SeIncreaseQuotaPrivilege 4940 WMIC.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4928 wrote to memory of 2436 4928 instal_win64.exe 80 PID 4928 wrote to memory of 2436 4928 instal_win64.exe 80 PID 4928 wrote to memory of 2436 4928 instal_win64.exe 80 PID 4928 wrote to memory of 4924 4928 instal_win64.exe 84 PID 4928 wrote to memory of 4924 4928 instal_win64.exe 84 PID 4928 wrote to memory of 4924 4928 instal_win64.exe 84 PID 4924 wrote to memory of 4940 4924 cmd.exe 87 PID 4924 wrote to memory of 4940 4924 cmd.exe 87 PID 4924 wrote to memory of 4940 4924 cmd.exe 87 PID 4928 wrote to memory of 2156 4928 instal_win64.exe 89 PID 4928 wrote to memory of 2156 4928 instal_win64.exe 89 PID 4928 wrote to memory of 2156 4928 instal_win64.exe 89 PID 2156 wrote to memory of 3240 2156 cmd.exe 91 PID 2156 wrote to memory of 3240 2156 cmd.exe 91 PID 2156 wrote to memory of 3240 2156 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\instal_win64.exe"C:\Users\Admin\AppData\Local\Temp\instal_win64.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵PID:3240
-
-