Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-03-2023 09:41

General

  • Target

    7923c53381886a69939a56da10dcaa42.exe

  • Size

    6.8MB

  • MD5

    7923c53381886a69939a56da10dcaa42

  • SHA1

    a9f1879a7784933381548e9b8cf10462c3910693

  • SHA256

    2b0487817f8cf2592db53cea34fa30f2db1a06d046759f23f3e72a0dc61034dd

  • SHA512

    b701902129a3f067076d2aae6ac5d73c59eb4c843f51f45ad40e0c2103883246b2f0ac4da57368c51ac9dd10f6adcf2d5a78632ee319ca5c47b1d420c9de5d4a

  • SSDEEP

    98304:ftyBvUTI3/T/O5JtzAE0A050xf3yhDWbMsnJfdViU7DICtzkcPLC+5HTb/hIekb3:f8JRaXQ2xfaWYsJlVdDIaL9b5fzC/

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 16 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7923c53381886a69939a56da10dcaa42.exe
    "C:\Users\Admin\AppData\Local\Temp\7923c53381886a69939a56da10dcaa42.exe"
    1⤵
    • Checks computer location settings
    • Maps connected drives based on registry
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Roaming\7CBC5073C00A43F3\jaudie.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4472
      • C:\Users\Admin\AppData\Roaming\7CBC5073C00A43F3\jaudie.exe
        C:\Users\Admin\AppData\Roaming\7CBC5073C00A43F3\jaudie.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1340
        • C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
          "C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          PID:3732
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout -t 5 && del "C:\Users\Admin\AppData\Local\Temp\7923c53381886a69939a56da10dcaa42.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\SysWOW64\timeout.exe
        timeout -t 5
        3⤵
        • Delays execution with timeout.exe
        PID:4316

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

6
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7ED0.tmp
    Filesize

    32B

    MD5

    30b13d77deed1641dd87896b3fa0afd9

    SHA1

    466d549e6855c627e2901601e87b05bbc0f2c8fa

    SHA256

    1c359e1bda712f001a46a9044a202219838ee31cd29cc7551090a2db0913399a

    SHA512

    bfe239b285f044b3a01c938deb809bdd65ed3adb572c4ff909c25bcf5e036a6453ee1595b0d7b7c89334391e7128358e9d187f90e39c7dafbd58ccd928d7098e

  • C:\Users\Admin\AppData\Local\Temp\8089.tmp
    Filesize

    71KB

    MD5

    fb2e05653c3115d89013daa5132f08e0

    SHA1

    8ad3d1f4c1652c1e173d3201faf9fdd22b229351

    SHA256

    895ce9cfa9bd4ce960723e7adf0aba7eefff4c8cd5e46cad13cb791a39665077

    SHA512

    ca9b7fac566026fa87872d3fdfa32a5a571613b8d9cd4364e1b05d0682d52844c9d1a28c292d6d129d506a627a6cef2a0e6329f8c2ab28cd4388789f48399238

  • C:\Users\Admin\AppData\Local\Temp\86EE.tmp
    Filesize

    2KB

    MD5

    1d65ace99a200cf0ac042936baf39f68

    SHA1

    acd9cd136a2b583c7d89dcbeffad15316921b145

    SHA256

    59f9c188335405db46c008bcd919293d3ea2e549db72d9f0f83ef34195809bc6

    SHA512

    bfc0c01bdca82c7d5ff2210d59049a65930500eaf40b26c2aa6d6149b971b5db63edc12ee5a0ee0ccd8a33bcfcb1063eb1bcf1bbc63788976baee47224bdf486

  • C:\Users\Admin\AppData\Roaming\7CBC5073C00A43F3\jaudie.exe
    Filesize

    2.8MB

    MD5

    8c3b5ff6c965a848dbd1c4b176858bd5

    SHA1

    fcfd484b841b1cc6817dac5a53fda85c7ba67714

    SHA256

    c3bc43cdd95807cf49f9076ef36fbc54036606b8054b20e6896d43045e134d73

    SHA512

    a7c323bee8a2473b7e093af265de322355bbaf82661486dcd79b17c1049412e94ac5dc92588a4c387e629722f10ef3b1571a29cc057be0aa95c22f428a0b3e07

  • C:\Users\Admin\AppData\Roaming\7CBC5073C00A43F3\jaudie.exe
    Filesize

    2.8MB

    MD5

    8c3b5ff6c965a848dbd1c4b176858bd5

    SHA1

    fcfd484b841b1cc6817dac5a53fda85c7ba67714

    SHA256

    c3bc43cdd95807cf49f9076ef36fbc54036606b8054b20e6896d43045e134d73

    SHA512

    a7c323bee8a2473b7e093af265de322355bbaf82661486dcd79b17c1049412e94ac5dc92588a4c387e629722f10ef3b1571a29cc057be0aa95c22f428a0b3e07

  • C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
    Filesize

    2.8MB

    MD5

    8c3b5ff6c965a848dbd1c4b176858bd5

    SHA1

    fcfd484b841b1cc6817dac5a53fda85c7ba67714

    SHA256

    c3bc43cdd95807cf49f9076ef36fbc54036606b8054b20e6896d43045e134d73

    SHA512

    a7c323bee8a2473b7e093af265de322355bbaf82661486dcd79b17c1049412e94ac5dc92588a4c387e629722f10ef3b1571a29cc057be0aa95c22f428a0b3e07

  • C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
    Filesize

    2.8MB

    MD5

    8c3b5ff6c965a848dbd1c4b176858bd5

    SHA1

    fcfd484b841b1cc6817dac5a53fda85c7ba67714

    SHA256

    c3bc43cdd95807cf49f9076ef36fbc54036606b8054b20e6896d43045e134d73

    SHA512

    a7c323bee8a2473b7e093af265de322355bbaf82661486dcd79b17c1049412e94ac5dc92588a4c387e629722f10ef3b1571a29cc057be0aa95c22f428a0b3e07

  • memory/1340-251-0x00000000000F0000-0x0000000000834000-memory.dmp
    Filesize

    7.3MB

  • memory/1340-246-0x00000000000F0000-0x0000000000834000-memory.dmp
    Filesize

    7.3MB

  • memory/1340-255-0x00000000000F0000-0x0000000000834000-memory.dmp
    Filesize

    7.3MB

  • memory/1340-250-0x00000000000F0000-0x0000000000834000-memory.dmp
    Filesize

    7.3MB

  • memory/1340-249-0x00000000000F0000-0x0000000000834000-memory.dmp
    Filesize

    7.3MB

  • memory/1340-248-0x00000000000F0000-0x0000000000834000-memory.dmp
    Filesize

    7.3MB

  • memory/1340-247-0x00000000000F0000-0x0000000000834000-memory.dmp
    Filesize

    7.3MB

  • memory/2796-135-0x0000000001150000-0x0000000001151000-memory.dmp
    Filesize

    4KB

  • memory/2796-140-0x0000000000400000-0x0000000000F04000-memory.dmp
    Filesize

    11.0MB

  • memory/2796-134-0x0000000001030000-0x0000000001031000-memory.dmp
    Filesize

    4KB

  • memory/2796-133-0x0000000001020000-0x0000000001021000-memory.dmp
    Filesize

    4KB

  • memory/2796-138-0x0000000002CB0000-0x0000000002CB1000-memory.dmp
    Filesize

    4KB

  • memory/2796-136-0x0000000002C90000-0x0000000002C91000-memory.dmp
    Filesize

    4KB

  • memory/2796-137-0x0000000002CA0000-0x0000000002CA1000-memory.dmp
    Filesize

    4KB

  • memory/2796-139-0x0000000002CC0000-0x0000000002CC1000-memory.dmp
    Filesize

    4KB

  • memory/3732-257-0x0000000000400000-0x0000000000B44000-memory.dmp
    Filesize

    7.3MB

  • memory/3732-258-0x0000000000400000-0x0000000000B44000-memory.dmp
    Filesize

    7.3MB

  • memory/3732-259-0x0000000000400000-0x0000000000B44000-memory.dmp
    Filesize

    7.3MB

  • memory/3732-260-0x0000000000400000-0x0000000000B44000-memory.dmp
    Filesize

    7.3MB

  • memory/3732-261-0x0000000000400000-0x0000000000B44000-memory.dmp
    Filesize

    7.3MB