Analysis
-
max time kernel
1687s -
max time network
1700s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2023 11:35
Behavioral task
behavioral1
Sample
AridekVM.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
AridekVM.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
patcher.exe
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
patcher.exe
Resource
win10v2004-20230220-en
General
-
Target
AridekVM.exe
-
Size
12.9MB
-
MD5
7550996532016fa5bb2e7fcee4fbf1a4
-
SHA1
e0f0d2b17c03477196209ee9635f2a11283027d8
-
SHA256
c0afd7d86cb0586db959d19db36345676437acb53140ea9d91e6201041cadae7
-
SHA512
935714dc724e7c3e0f02fff28e0cf8c4eec81a3ea2c3c79669e99837fc77ac15e62456cda11771943c578075a6c74e6d01512c7e90048d527c96f60df18ef131
-
SSDEEP
196608:dEGgxWcn/V+7huajaJ+RWgKf4it0d3sbPKjGyhZvEwrPjVlQozzB4dDTe:dEjxWKNihNaJEW4Wis+DMwnQxi
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
AridekVM.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ AridekVM.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
AridekVM.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AridekVM.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AridekVM.exe -
Processes:
resource yara_rule behavioral2/memory/1304-133-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida behavioral2/memory/1304-134-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida behavioral2/memory/1304-135-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida behavioral2/memory/1304-136-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida behavioral2/memory/1304-137-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida behavioral2/memory/1304-138-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida behavioral2/memory/1304-139-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida behavioral2/memory/1304-140-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida behavioral2/memory/1304-141-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida behavioral2/memory/1304-142-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida behavioral2/memory/1304-143-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida behavioral2/memory/1304-144-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida behavioral2/memory/1304-145-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmp themida -
Processes:
AridekVM.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AridekVM.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 50 IoCs
Processes:
AridekVM.exepid process 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4036 232 WerFault.exe 1628 1304 WerFault.exe AridekVM.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AridekVM.exepid process 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe 1304 AridekVM.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
AridekVM.execmd.exedescription pid process target process PID 1304 wrote to memory of 2040 1304 AridekVM.exe cmd.exe PID 1304 wrote to memory of 2040 1304 AridekVM.exe cmd.exe PID 1304 wrote to memory of 1668 1304 AridekVM.exe cmd.exe PID 1304 wrote to memory of 1668 1304 AridekVM.exe cmd.exe PID 1304 wrote to memory of 2184 1304 AridekVM.exe cmd.exe PID 1304 wrote to memory of 2184 1304 AridekVM.exe cmd.exe PID 2184 wrote to memory of 3560 2184 cmd.exe certutil.exe PID 2184 wrote to memory of 3560 2184 cmd.exe certutil.exe PID 2184 wrote to memory of 2836 2184 cmd.exe find.exe PID 2184 wrote to memory of 2836 2184 cmd.exe find.exe PID 2184 wrote to memory of 1672 2184 cmd.exe find.exe PID 2184 wrote to memory of 1672 2184 cmd.exe find.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AridekVM.exe"C:\Users\Admin\AppData\Local\Temp\AridekVM.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\AridekVM.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\AridekVM.exe" MD53⤵
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1304 -s 8882⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 436 -p 232 -ip 2321⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 232 -s 16841⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 564 -p 1304 -ip 13041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1304-133-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB
-
memory/1304-134-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB
-
memory/1304-135-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB
-
memory/1304-136-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB
-
memory/1304-137-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB
-
memory/1304-138-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB
-
memory/1304-139-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB
-
memory/1304-140-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB
-
memory/1304-141-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB
-
memory/1304-142-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB
-
memory/1304-143-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB
-
memory/1304-144-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB
-
memory/1304-145-0x00007FF7B1E90000-0x00007FF7B3891000-memory.dmpFilesize
26.0MB