Analysis

  • max time kernel
    148s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-03-2023 14:34

General

  • Target

    23e3550cb43e9362251d56005e3c961c426d8e065ff2f2123f457e217415f6c1.exe

  • Size

    6.8MB

  • MD5

    ca6b1b3b00d1bdccb7cc73255bc97329

  • SHA1

    88923d5bf5f29cab5fe3ac66459bc94d709b06a1

  • SHA256

    23e3550cb43e9362251d56005e3c961c426d8e065ff2f2123f457e217415f6c1

  • SHA512

    fd92162cb9fc5f0a22e25b17cf9386034121af061b821531823292778978f7f44c2e51a7eadc07e902560ec8cffd389a40dd32649ffe3782fbf956dc293224b3

  • SSDEEP

    196608:V09b1yxhIsD1xLyVUZIBZjUQHQ8dq9XvjUQ:V09bsBvy2GjeV

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 18 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23e3550cb43e9362251d56005e3c961c426d8e065ff2f2123f457e217415f6c1.exe
    "C:\Users\Admin\AppData\Local\Temp\23e3550cb43e9362251d56005e3c961c426d8e065ff2f2123f457e217415f6c1.exe"
    1⤵
    • Checks computer location settings
    • Maps connected drives based on registry
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Roaming\7CBC507339E8C4AC\uptorn.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Users\Admin\AppData\Roaming\7CBC507339E8C4AC\uptorn.exe
        C:\Users\Admin\AppData\Roaming\7CBC507339E8C4AC\uptorn.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4328
        • C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
          "C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          PID:4064
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout -t 5 && del "C:\Users\Admin\AppData\Local\Temp\23e3550cb43e9362251d56005e3c961c426d8e065ff2f2123f457e217415f6c1.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3968
      • C:\Windows\SysWOW64\timeout.exe
        timeout -t 5
        3⤵
        • Delays execution with timeout.exe
        PID:3284

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

6
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\A6F9.tmp
    Filesize

    32B

    MD5

    30b13d77deed1641dd87896b3fa0afd9

    SHA1

    466d549e6855c627e2901601e87b05bbc0f2c8fa

    SHA256

    1c359e1bda712f001a46a9044a202219838ee31cd29cc7551090a2db0913399a

    SHA512

    bfe239b285f044b3a01c938deb809bdd65ed3adb572c4ff909c25bcf5e036a6453ee1595b0d7b7c89334391e7128358e9d187f90e39c7dafbd58ccd928d7098e

  • C:\Users\Admin\AppData\Local\Temp\AB62.tmp
    Filesize

    71KB

    MD5

    fb2e05653c3115d89013daa5132f08e0

    SHA1

    8ad3d1f4c1652c1e173d3201faf9fdd22b229351

    SHA256

    895ce9cfa9bd4ce960723e7adf0aba7eefff4c8cd5e46cad13cb791a39665077

    SHA512

    ca9b7fac566026fa87872d3fdfa32a5a571613b8d9cd4364e1b05d0682d52844c9d1a28c292d6d129d506a627a6cef2a0e6329f8c2ab28cd4388789f48399238

  • C:\Users\Admin\AppData\Local\Temp\C790.tmp
    Filesize

    2KB

    MD5

    1d65ace99a200cf0ac042936baf39f68

    SHA1

    acd9cd136a2b583c7d89dcbeffad15316921b145

    SHA256

    59f9c188335405db46c008bcd919293d3ea2e549db72d9f0f83ef34195809bc6

    SHA512

    bfc0c01bdca82c7d5ff2210d59049a65930500eaf40b26c2aa6d6149b971b5db63edc12ee5a0ee0ccd8a33bcfcb1063eb1bcf1bbc63788976baee47224bdf486

  • C:\Users\Admin\AppData\Roaming\7CBC507339E8C4AC\uptorn.exe
    Filesize

    2.7MB

    MD5

    c958ae268c1966cdce74530648a61e99

    SHA1

    704274ad1b508f7dcc2839519030ac9ff6f66a20

    SHA256

    cabce825f470146722193da1daaf7c14930ccc251362656a93885fdc4a51f245

    SHA512

    ee582850228d0f608e41d626b2c2d74bc12e3ff15e10ed09da4ae128cd1717dfcfcb8b873e3abb1858ed959a327214e2cbf1d92c8bb1ebaf11159982db6c2cae

  • C:\Users\Admin\AppData\Roaming\7CBC507339E8C4AC\uptorn.exe
    Filesize

    2.7MB

    MD5

    c958ae268c1966cdce74530648a61e99

    SHA1

    704274ad1b508f7dcc2839519030ac9ff6f66a20

    SHA256

    cabce825f470146722193da1daaf7c14930ccc251362656a93885fdc4a51f245

    SHA512

    ee582850228d0f608e41d626b2c2d74bc12e3ff15e10ed09da4ae128cd1717dfcfcb8b873e3abb1858ed959a327214e2cbf1d92c8bb1ebaf11159982db6c2cae

  • C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
    Filesize

    2.7MB

    MD5

    c958ae268c1966cdce74530648a61e99

    SHA1

    704274ad1b508f7dcc2839519030ac9ff6f66a20

    SHA256

    cabce825f470146722193da1daaf7c14930ccc251362656a93885fdc4a51f245

    SHA512

    ee582850228d0f608e41d626b2c2d74bc12e3ff15e10ed09da4ae128cd1717dfcfcb8b873e3abb1858ed959a327214e2cbf1d92c8bb1ebaf11159982db6c2cae

  • C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
    Filesize

    2.7MB

    MD5

    c958ae268c1966cdce74530648a61e99

    SHA1

    704274ad1b508f7dcc2839519030ac9ff6f66a20

    SHA256

    cabce825f470146722193da1daaf7c14930ccc251362656a93885fdc4a51f245

    SHA512

    ee582850228d0f608e41d626b2c2d74bc12e3ff15e10ed09da4ae128cd1717dfcfcb8b873e3abb1858ed959a327214e2cbf1d92c8bb1ebaf11159982db6c2cae

  • memory/1108-140-0x0000000000400000-0x0000000000F02000-memory.dmp
    Filesize

    11.0MB

  • memory/1108-135-0x00000000011D0000-0x00000000011D1000-memory.dmp
    Filesize

    4KB

  • memory/1108-139-0x0000000001220000-0x0000000001221000-memory.dmp
    Filesize

    4KB

  • memory/1108-138-0x0000000001210000-0x0000000001211000-memory.dmp
    Filesize

    4KB

  • memory/1108-137-0x0000000001200000-0x0000000001201000-memory.dmp
    Filesize

    4KB

  • memory/1108-136-0x00000000011F0000-0x00000000011F1000-memory.dmp
    Filesize

    4KB

  • memory/1108-133-0x0000000001060000-0x0000000001061000-memory.dmp
    Filesize

    4KB

  • memory/1108-134-0x00000000011C0000-0x00000000011C1000-memory.dmp
    Filesize

    4KB

  • memory/4064-263-0x00000000000D0000-0x00000000007BB000-memory.dmp
    Filesize

    6.9MB

  • memory/4064-261-0x00000000000D0000-0x00000000007BB000-memory.dmp
    Filesize

    6.9MB

  • memory/4064-260-0x00000000000D0000-0x00000000007BB000-memory.dmp
    Filesize

    6.9MB

  • memory/4064-259-0x00000000000D0000-0x00000000007BB000-memory.dmp
    Filesize

    6.9MB

  • memory/4064-262-0x00000000000D0000-0x00000000007BB000-memory.dmp
    Filesize

    6.9MB

  • memory/4064-258-0x00000000000D0000-0x00000000007BB000-memory.dmp
    Filesize

    6.9MB

  • memory/4064-257-0x00000000000D0000-0x00000000007BB000-memory.dmp
    Filesize

    6.9MB

  • memory/4328-246-0x0000000000E80000-0x000000000156B000-memory.dmp
    Filesize

    6.9MB

  • memory/4328-254-0x0000000000E80000-0x000000000156B000-memory.dmp
    Filesize

    6.9MB

  • memory/4328-251-0x0000000000E80000-0x000000000156B000-memory.dmp
    Filesize

    6.9MB

  • memory/4328-250-0x0000000000E80000-0x000000000156B000-memory.dmp
    Filesize

    6.9MB

  • memory/4328-249-0x0000000000E80000-0x000000000156B000-memory.dmp
    Filesize

    6.9MB

  • memory/4328-248-0x0000000000E80000-0x000000000156B000-memory.dmp
    Filesize

    6.9MB

  • memory/4328-247-0x0000000000E80000-0x000000000156B000-memory.dmp
    Filesize

    6.9MB