sectoprat | 104645c74843e385754502a80a935156b585c6969fba1be83efe9b554a746560

Virtualization/Sandbox Evasion

T1497

Processes:

f6ed1f34f629ab51dba4c63dc57c1a91.exekecovi.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f6ed1f34f629ab51dba4c63dc57c1a91.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	kecovi.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

f6ed1f34f629ab51dba4c63dc57c1a91.exekecovi.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f6ed1f34f629ab51dba4c63dc57c1a91.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f6ed1f34f629ab51dba4c63dc57c1a91.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	kecovi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	kecovi.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

f6ed1f34f629ab51dba4c63dc57c1a91.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	f6ed1f34f629ab51dba4c63dc57c1a91.exe

Drops startup file 2 IoCs

Processes:

f6ed1f34f629ab51dba4c63dc57c1a91.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\camilixato.url	f6ed1f34f629ab51dba4c63dc57c1a91.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\camilixato.url	f6ed1f34f629ab51dba4c63dc57c1a91.exe

Executes dropped EXE 1 IoCs

Processes:

kecovi.exe

pid process

4968 kecovi.exe

pid	process
4968	kecovi.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

f6ed1f34f629ab51dba4c63dc57c1a91.exekecovi.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f6ed1f34f629ab51dba4c63dc57c1a91.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kecovi.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

f6ed1f34f629ab51dba4c63dc57c1a91.exekecovi.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	f6ed1f34f629ab51dba4c63dc57c1a91.exe
File opened for modification	\??\PhysicalDrive0	kecovi.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

f6ed1f34f629ab51dba4c63dc57c1a91.exekecovi.exe

pid process

4352 f6ed1f34f629ab51dba4c63dc57c1a91.exe
4968 kecovi.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

kecovi.exe

description pid process target process

PID 4968 set thread context of 4016 4968 kecovi.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3940 PING.EXE

description	pid	process	target process
PID 4968 set thread context of 4016	4968	kecovi.exe	InstallUtil.exe

pid	process
3940	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

f6ed1f34f629ab51dba4c63dc57c1a91.exekecovi.exe

pid	process
4352	f6ed1f34f629ab51dba4c63dc57c1a91.exe
4352	f6ed1f34f629ab51dba4c63dc57c1a91.exe
4352	f6ed1f34f629ab51dba4c63dc57c1a91.exe
4352	f6ed1f34f629ab51dba4c63dc57c1a91.exe
4968	kecovi.exe
4968	kecovi.exe
4968	kecovi.exe
4968	kecovi.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 4016 InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	4016	InstallUtil.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

f6ed1f34f629ab51dba4c63dc57c1a91.execmd.exekecovi.exe

description	pid	process	target process
PID 4352 wrote to memory of 4968	4352	f6ed1f34f629ab51dba4c63dc57c1a91.exe	kecovi.exe
PID 4352 wrote to memory of 4968	4352	f6ed1f34f629ab51dba4c63dc57c1a91.exe	kecovi.exe
PID 4352 wrote to memory of 4968	4352	f6ed1f34f629ab51dba4c63dc57c1a91.exe	kecovi.exe
PID 4352 wrote to memory of 3472	4352	f6ed1f34f629ab51dba4c63dc57c1a91.exe	cmd.exe
PID 4352 wrote to memory of 3472	4352	f6ed1f34f629ab51dba4c63dc57c1a91.exe	cmd.exe
PID 4352 wrote to memory of 3472	4352	f6ed1f34f629ab51dba4c63dc57c1a91.exe	cmd.exe
PID 3472 wrote to memory of 3940	3472	cmd.exe	PING.EXE
PID 3472 wrote to memory of 3940	3472	cmd.exe	PING.EXE
PID 3472 wrote to memory of 3940	3472	cmd.exe	PING.EXE
PID 4968 wrote to memory of 4016	4968	kecovi.exe	InstallUtil.exe
PID 4968 wrote to memory of 4016	4968	kecovi.exe	InstallUtil.exe
PID 4968 wrote to memory of 4016	4968	kecovi.exe	InstallUtil.exe
PID 4968 wrote to memory of 4016	4968	kecovi.exe	InstallUtil.exe
PID 4968 wrote to memory of 4016	4968	kecovi.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\f6ed1f34f629ab51dba4c63dc57c1a91.exe
"C:\Users\Admin\AppData\Local\Temp\f6ed1f34f629ab51dba4c63dc57c1a91.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Drops startup file
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4352

C:\ProgramData\kidequoxayes\kecovi.exe
"C:\ProgramData\kidequoxayes\kecovi.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c @echo off & ping 127.0.0.1 -n 5 -w 1000 > nul & del "C:\Users\Admin\AppData\Local\Temp\f6ed1f34f629ab51dba4c63dc57c1a91.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3472

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5 -w 1000
3⤵
- Runs ping.exe
PID:3940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

3

Virtualization/Sandbox Evasion

T1497

System Information Discovery

4

Remote System Discovery