Overview

overview

9

Static

static

7

AridekVM.exe

windows10-1703-x64

9

AridekVM.exe

windows10-2004-x64

9

patcher.exe

windows10-1703-x64

1

patcher.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    1787s
  • max time network
    1798s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26-03-2023 11:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AridekVM.exe

  • Size

    12.9MB

  • MD5

    7550996532016fa5bb2e7fcee4fbf1a4

  • SHA1

    e0f0d2b17c03477196209ee9635f2a11283027d8

  • SHA256

    c0afd7d86cb0586db959d19db36345676437acb53140ea9d91e6201041cadae7

  • SHA512

    935714dc724e7c3e0f02fff28e0cf8c4eec81a3ea2c3c79669e99837fc77ac15e62456cda11771943c578075a6c74e6d01512c7e90048d527c96f60df18ef131

  • SSDEEP

    196608:dEGgxWcn/V+7huajaJ+RWgKf4it0d3sbPKjGyhZvEwrPjVlQozzB4dDTe:dEjxWKNihNaJEW4Wis+DMwnQxi

Score
9/10
evasionpersistencethemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Themida packer 12 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AridekVM.exe
    "C:\Users\Admin\AppData\Local\Temp\AridekVM.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:2496
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        2⤵
          PID:2820
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\AridekVM.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2928
          • C:\Windows\system32\certutil.exe
            certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\AridekVM.exe" MD5
            3⤵
              PID:3164
            • C:\Windows\system32\find.exe
              find /i /v "certutil"
              3⤵
                PID:5056
              • C:\Windows\system32\find.exe
                find /i /v "md5"
                3⤵
                  PID:4388
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 1240 -s 824
                2⤵
                • Program crash
                PID:3888
            • C:\Windows\System32\rundll32.exe
              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
              1⤵
                PID:3884
              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
                1⤵
                • Modifies system executable filetype association
                • Registers COM server for autorun
                • Checks processor information in registry
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:1492

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Initial Access

              Execution

              Persistence

              Change Default File Association

              1
              T1042

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              Defense Evasion

              Virtualization/Sandbox Evasion

              1
              T1497

              Modify Registry

              2
              T1112

              Credential Access

              Discovery

              Query Registry

              3
              T1012

              Virtualization/Sandbox Evasion

              1
              T1497

              System Information Discovery

              3
              T1082

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1240-121-0x00007FF7D5470000-0x00007FF7D6E71000-memory.dmp
                Filesize

                26.0MB

                Download
              • memory/1240-122-0x00007FF7D5470000-0x00007FF7D6E71000-memory.dmp
                Filesize

                26.0MB

                Download
              • memory/1240-123-0x00007FF7D5470000-0x00007FF7D6E71000-memory.dmp
                Filesize

                26.0MB

                Download
              • memory/1240-124-0x00007FF7D5470000-0x00007FF7D6E71000-memory.dmp
                Filesize

                26.0MB

                Download
              • memory/1240-125-0x00007FF7D5470000-0x00007FF7D6E71000-memory.dmp
                Filesize

                26.0MB

                Download
              • memory/1240-126-0x00007FF7D5470000-0x00007FF7D6E71000-memory.dmp
                Filesize

                26.0MB

                Download
              • memory/1240-127-0x00007FF7D5470000-0x00007FF7D6E71000-memory.dmp
                Filesize

                26.0MB

                Download
              • memory/1240-128-0x00007FF7D5470000-0x00007FF7D6E71000-memory.dmp
                Filesize

                26.0MB

                Download
              • memory/1240-129-0x00007FF7D5470000-0x00007FF7D6E71000-memory.dmp
                Filesize

                26.0MB

                Download
              • memory/1240-130-0x00007FF7D5470000-0x00007FF7D6E71000-memory.dmp
                Filesize

                26.0MB

                Download
              • memory/1240-131-0x00007FF7D5470000-0x00007FF7D6E71000-memory.dmp
                Filesize

                26.0MB

                Download
              • memory/1240-132-0x00007FF7D5470000-0x00007FF7D6E71000-memory.dmp
                Filesize

                26.0MB

                Download