Analysis
-
max time kernel
592s -
max time network
579s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-es -
resource tags
-
submitted
19-03-2023 14:15
General
-
Target
add_attack/goland.exe
-
Size
2.6MB
-
MD5
fc6d40512829e36687854cb0118a5a1e
-
SHA1
cf801f9dad93b5ebbcef79b093b034b45aa75a1e
-
SHA256
58c0d2f945207a56f5baefbb320d7ddbd01089205025de05133db173281e65e2
-
SHA512
8545d6e56ab77e28e416b013a2836307616d8c00dc26216c35fba8bc1ec0b8c8503f8d7cb55e8dd1d5aaa08875e9172f7259082a4f6756c4722be9c4e3f96e6f
-
SSDEEP
49152:6EE4S6KbgMczZ3kXz64kU4r6mN2udLglBA9iHZN9OXOMbK:VEV6Kbmhkj14rzUMnibX
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\add_attack\goland.exe"C:\Users\Admin\AppData\Local\Temp\add_attack\goland.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
790.6MB
MD5ea5a61f2842181ef7722e344bdca4438
SHA11d5a5356e5c37a8b96cd8cec913019922f0d6ef9
SHA25682a6a7dc706e459f9756d694863f58ec8cf2f658c3e692fe93cfacdba1113c35
SHA51282df870f4d7064ea8d9c7bd7135efd070c6eed7c9a2d50ce255927166d5e211d515491da6a97484c36f014fdaa277a5f216d73540cc844ce48727b9797379e7f
-
Filesize
790.6MB
MD5ea5a61f2842181ef7722e344bdca4438
SHA11d5a5356e5c37a8b96cd8cec913019922f0d6ef9
SHA25682a6a7dc706e459f9756d694863f58ec8cf2f658c3e692fe93cfacdba1113c35
SHA51282df870f4d7064ea8d9c7bd7135efd070c6eed7c9a2d50ce255927166d5e211d515491da6a97484c36f014fdaa277a5f216d73540cc844ce48727b9797379e7f
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB