601b112502f810f643b1c87b245f50533b472c13d87e69c187ce46daefe63bcf

General

Target

LolScriptV13.1/LolScriptV13.1/LolScript/LolScript.exe
Size

11.0MB
MD5

15f8670edce8902831bf9541c8749e90
SHA1

bcb53912c22a7328e3ead74b5dd01400d6ee5536
SHA256

f8bae3cd04ff1b52391dc3c62f5e47a44be2271dcba9964290ce5f81b0e32e85
SHA512

8ce3d82ffa17d5e1a15f37f08f0af54a86e9100806dda7c099e1758fff41c9a60b0658e93cbeec0465e70280296ef545054d1d3927fdbcd6468361528fb8c5fc
SSDEEP

196608:QsKmZRO75oqIqZzeYZ14asm96c0p7rUMNsMC/pb4jKooMFteo4XTi22MXW1jAiJn:QsXZIPIaR+UGxrpNsM2pb4jK1osTi20P

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

LolScript.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ LolScript.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LolScript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LolScript.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LolScript.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LolScript.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

LolScript.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LolScript.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

LolScript.exe

pid process

2044 LolScript.exe
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

1012 reg.exe
524 reg.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

LolScript.exe

pid process

2044 LolScript.exe
2044 LolScript.exe
2044 LolScript.exe
2044 LolScript.exe
2044 LolScript.exe
2044 LolScript.exe
2044 LolScript.exe
2044 LolScript.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

LolScript.exe

pid process

2044 LolScript.exe
2044 LolScript.exe
2044 LolScript.exe
2044 LolScript.exe
2044 LolScript.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LolScript.exe

pid	process
2044	LolScript.exe

pid	process
1012	reg.exe
524	reg.exe

pid	process
2044	LolScript.exe
2044	LolScript.exe
2044	LolScript.exe
2044	LolScript.exe
2044	LolScript.exe
2044	LolScript.exe
2044	LolScript.exe
2044	LolScript.exe

pid	process
2044	LolScript.exe
2044	LolScript.exe
2044	LolScript.exe
2044	LolScript.exe
2044	LolScript.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

LolScript.execmd.execmd.exe

description	pid	process	target process
PID 2044 wrote to memory of 960	2044	LolScript.exe	cmd.exe
PID 2044 wrote to memory of 960	2044	LolScript.exe	cmd.exe
PID 2044 wrote to memory of 960	2044	LolScript.exe	cmd.exe
PID 2044 wrote to memory of 960	2044	LolScript.exe	cmd.exe
PID 960 wrote to memory of 1012	960	cmd.exe	reg.exe
PID 960 wrote to memory of 1012	960	cmd.exe	reg.exe
PID 960 wrote to memory of 1012	960	cmd.exe	reg.exe
PID 960 wrote to memory of 1012	960	cmd.exe	reg.exe
PID 2044 wrote to memory of 268	2044	LolScript.exe	cmd.exe
PID 2044 wrote to memory of 268	2044	LolScript.exe	cmd.exe
PID 2044 wrote to memory of 268	2044	LolScript.exe	cmd.exe
PID 2044 wrote to memory of 268	2044	LolScript.exe	cmd.exe
PID 268 wrote to memory of 524	268	cmd.exe	reg.exe
PID 268 wrote to memory of 524	268	cmd.exe	reg.exe
PID 268 wrote to memory of 524	268	cmd.exe	reg.exe
PID 268 wrote to memory of 524	268	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\LolScriptV13.1\LolScriptV13.1\LolScript\LolScript.exe
"C:\Users\Admin\AppData\Local\Temp\LolScriptV13.1\LolScriptV13.1\LolScript\LolScript.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Start_TrackProgs" /t REG_DWORD /d 0 /f >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Start_TrackProgs" /t REG_DWORD /d 0 /f
3⤵
- Modifies registry key
PID:1012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Start_TrackEnabled" /t REG_DWORD /d 0 /f >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Start_TrackEnabled" /t REG_DWORD /d 0 /f
3⤵
- Modifies registry key
PID:524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-66-0x0000000000000000-mapping.dmp

Download
memory/524-67-0x0000000000000000-mapping.dmp

Download
memory/960-64-0x0000000000000000-mapping.dmp

Download
memory/1012-65-0x0000000000000000-mapping.dmp

Download
memory/2044-58-0x0000000000DC0000-0x000000000277E000-memory.dmp

Filesize
25.7MB

Download
memory/2044-59-0x0000000000DC0000-0x000000000277E000-memory.dmp

Filesize
25.7MB

Download
memory/2044-60-0x0000000000DC0000-0x000000000277E000-memory.dmp

Filesize
25.7MB

Download
memory/2044-61-0x0000000000DC0000-0x000000000277E000-memory.dmp

Filesize
25.7MB

Download
memory/2044-62-0x0000000000DC0000-0x000000000277E000-memory.dmp

Filesize
25.7MB

Download
memory/2044-63-0x0000000000DC0000-0x000000000277E000-memory.dmp

Filesize
25.7MB

Download
memory/2044-54-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x0000000000DC0000-0x000000000277E000-memory.dmp

Filesize
25.7MB

Download
memory/2044-55-0x0000000000DC0000-0x000000000277E000-memory.dmp

Filesize
25.7MB

Download
memory/2044-57-0x0000000077B10000-0x0000000077C90000-memory.dmp

Filesize
1.5MB

Download
memory/2044-68-0x0000000000DC0000-0x000000000277E000-memory.dmp

Filesize
25.7MB

Download
memory/2044-69-0x0000000000DC0000-0x000000000277E000-memory.dmp

Filesize
25.7MB

Download
memory/2044-70-0x0000000077B10000-0x0000000077C90000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing