601b112502f810f643b1c87b245f50533b472c13d87e69c187ce46daefe63bcf

General

Target

LolScriptV13.1/LolScriptV13.1/LolScript/LolScript.exe
Size

11.0MB
MD5

15f8670edce8902831bf9541c8749e90
SHA1

bcb53912c22a7328e3ead74b5dd01400d6ee5536
SHA256

f8bae3cd04ff1b52391dc3c62f5e47a44be2271dcba9964290ce5f81b0e32e85
SHA512

8ce3d82ffa17d5e1a15f37f08f0af54a86e9100806dda7c099e1758fff41c9a60b0658e93cbeec0465e70280296ef545054d1d3927fdbcd6468361528fb8c5fc
SSDEEP

196608:QsKmZRO75oqIqZzeYZ14asm96c0p7rUMNsMC/pb4jKooMFteo4XTi22MXW1jAiJn:QsXZIPIaR+UGxrpNsM2pb4jK1osTi20P

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

LolScript.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ LolScript.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LolScript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LolScript.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LolScript.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LolScript.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

LolScript.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LolScript.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

LolScript.exe

pid process

3272 LolScript.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4856 3272 WerFault.exe LolScript.exe
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

2648 reg.exe
4544 reg.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

LolScript.exe

pid process

3272 LolScript.exe
3272 LolScript.exe
3272 LolScript.exe
3272 LolScript.exe
3272 LolScript.exe
3272 LolScript.exe
3272 LolScript.exe
3272 LolScript.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

LolScript.exe

pid process

3272 LolScript.exe
3272 LolScript.exe
3272 LolScript.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LolScript.exe

pid	process
3272	LolScript.exe

pid	pid_target	process	target process
4856	3272	WerFault.exe	LolScript.exe

pid	process
2648	reg.exe
4544	reg.exe

pid	process
3272	LolScript.exe
3272	LolScript.exe
3272	LolScript.exe
3272	LolScript.exe
3272	LolScript.exe
3272	LolScript.exe
3272	LolScript.exe
3272	LolScript.exe

pid	process
3272	LolScript.exe
3272	LolScript.exe
3272	LolScript.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

LolScript.execmd.execmd.exe

description	pid	process	target process
PID 3272 wrote to memory of 1136	3272	LolScript.exe	cmd.exe
PID 3272 wrote to memory of 1136	3272	LolScript.exe	cmd.exe
PID 3272 wrote to memory of 1136	3272	LolScript.exe	cmd.exe
PID 1136 wrote to memory of 2648	1136	cmd.exe	reg.exe
PID 1136 wrote to memory of 2648	1136	cmd.exe	reg.exe
PID 1136 wrote to memory of 2648	1136	cmd.exe	reg.exe
PID 3272 wrote to memory of 3500	3272	LolScript.exe	cmd.exe
PID 3272 wrote to memory of 3500	3272	LolScript.exe	cmd.exe
PID 3272 wrote to memory of 3500	3272	LolScript.exe	cmd.exe
PID 3500 wrote to memory of 4544	3500	cmd.exe	reg.exe
PID 3500 wrote to memory of 4544	3500	cmd.exe	reg.exe
PID 3500 wrote to memory of 4544	3500	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\LolScriptV13.1\LolScriptV13.1\LolScript\LolScript.exe
"C:\Users\Admin\AppData\Local\Temp\LolScriptV13.1\LolScriptV13.1\LolScript\LolScript.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3272

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Start_TrackProgs" /t REG_DWORD /d 0 /f >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Start_TrackProgs" /t REG_DWORD /d 0 /f
3⤵
- Modifies registry key
PID:2648

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Start_TrackEnabled" /t REG_DWORD /d 0 /f >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:3500

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Start_TrackEnabled" /t REG_DWORD /d 0 /f
3⤵
- Modifies registry key
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 732
2⤵
- Program crash
PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3272 -ip 3272
1⤵
PID:4916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-141-0x0000000000000000-mapping.dmp

Download
memory/2648-142-0x0000000000000000-mapping.dmp

Download
memory/3272-135-0x00000000007C0000-0x000000000217E000-memory.dmp

Filesize
25.7MB

Download
memory/3272-132-0x00000000007C0000-0x000000000217E000-memory.dmp

Filesize
25.7MB

Download
memory/3272-136-0x00000000007C0000-0x000000000217E000-memory.dmp

Filesize
25.7MB

Download
memory/3272-137-0x00000000007C0000-0x000000000217E000-memory.dmp

Filesize
25.7MB

Download
memory/3272-138-0x00000000007C0000-0x000000000217E000-memory.dmp

Filesize
25.7MB

Download
memory/3272-139-0x00000000007C0000-0x000000000217E000-memory.dmp

Filesize
25.7MB

Download
memory/3272-140-0x00000000007C0000-0x000000000217E000-memory.dmp

Filesize
25.7MB

Download
memory/3272-134-0x00000000007C0000-0x000000000217E000-memory.dmp

Filesize
25.7MB

Download
memory/3272-133-0x0000000077730000-0x00000000778D3000-memory.dmp

Filesize
1.6MB

Download
memory/3272-145-0x00000000007C0000-0x000000000217E000-memory.dmp

Filesize
25.7MB

Download
memory/3272-146-0x0000000077730000-0x00000000778D3000-memory.dmp

Filesize
1.6MB

Download
memory/3500-143-0x0000000000000000-mapping.dmp

Download
memory/4544-144-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing