Analysis
-
max time kernel
128s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
21/03/2023, 05:46
General
-
Target
2a9e7c533ef29c4c39ee61f7154d18c6.exe
-
Size
4.9MB
-
MD5
2a9e7c533ef29c4c39ee61f7154d18c6
-
SHA1
6d288064e15bf370ae49ca7b1bd4a906c403e821
-
SHA256
5ca073902855e78c2225d74c98ea68c4c7b0235c53150e3a6986b73934f19062
-
SHA512
987f4581405f99461634534b8cb35a20f37700bf5ce463e24a53ea3dec9740aeb7d0b2300943ae74ae857bcad0cc71f0cccdd580ac7249c1f51c8c002f85c75d
-
SSDEEP
98304:Z7mSREy3EB1ZucSijV6lMo5ikEwhqr7nANR:Z3R735cS8Evhqra
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Themida packer 35 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a9e7c533ef29c4c39ee61f7154d18c6.exe"C:\Users\Admin\AppData\Local\Temp\2a9e7c533ef29c4c39ee61f7154d18c6.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
715.7MB
MD55123dfa5179ed6634977ea5ccf87fb83
SHA10f73b995daaf7594cc9abd4b7cd9c0600959f1de
SHA256960db9480de1d4f075c6bf6c4c9deae78c7b9794c5bb1c6ad6f72d73f6fb7432
SHA5125f392c0f49613c8ec339b88245406d8a2f28af7c21f677a3d77b0edc98943b659ca73541bd51614c38bf8da65bf30341dd1c8bb814bf1baf59718883f6906a52
-
Filesize
715.1MB
MD548f8bd69775623a53053519139f700d8
SHA1c3910a59eda53567c6bdc5060cf1079440686521
SHA25697df32c7969ca00012d76217f12d4422febe3b9c744a14598bfb06bfeaf6c7c0
SHA512d949966ac8edd4cebd35cb08aac16cf93c981d37fe508bebc91dc2681cf77717251b994b6ebafcd97842f20033a47ba21d869aa4260a3c100465ed636ae104e2
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
8.4MB