e97de3c318532ff7b6708d5da4f6864ec8b6315760d56736ace4834af99af1d5

General

Target

blueberry_valorant_external_free.exe
Size

4.3MB
MD5

aaaacda428369e9232ce8823b4a81f48
SHA1

c81f44134cddf51ba05da3c42327c084e239a956
SHA256

e97de3c318532ff7b6708d5da4f6864ec8b6315760d56736ace4834af99af1d5
SHA512

32225ee9eb191fb1797207fdbd518c6879f5bdf0e8d8bd1c8081a5b1938904ed80ae94f6928725a9bf691531b99db1ded47d890607aa4e9e0a8183173d9d2867
SSDEEP

98304:oj6Zo4FxbjVj69T4wrXuIPdqkf0SodDK3D5l4zdro7hW8vU8:3oA/j6pxQkw+lwk7Pvb

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

blueberry_valorant_external_free.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ blueberry_valorant_external_free.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	blueberry_valorant_external_free.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

blueberry_valorant_external_free.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	blueberry_valorant_external_free.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	blueberry_valorant_external_free.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1536-54-0x000000013F6E0000-0x000000014023C000-memory.dmp	themida
behavioral1/memory/1536-55-0x000000013F6E0000-0x000000014023C000-memory.dmp	themida
behavioral1/memory/1536-56-0x000000013F6E0000-0x000000014023C000-memory.dmp	themida
behavioral1/memory/1536-57-0x000000013F6E0000-0x000000014023C000-memory.dmp	themida
behavioral1/memory/1536-58-0x000000013F6E0000-0x000000014023C000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

blueberry_valorant_external_free.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	blueberry_valorant_external_free.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

blueberry_valorant_external_free.exe

pid process

1536 blueberry_valorant_external_free.exe

pid	process
1536	blueberry_valorant_external_free.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9AEB04C1-CE7E-11ED-A85F-D28FF4BEF639} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1764 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1764 iexplore.exe
1764 iexplore.exe
1396 IEXPLORE.EXE
1396 IEXPLORE.EXE

pid	process
1764	iexplore.exe

pid	process
1764	iexplore.exe
1764	iexplore.exe
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

blueberry_valorant_external_free.execmd.exeiexplore.exe

description	pid	process	target process
PID 1536 wrote to memory of 1756	1536	blueberry_valorant_external_free.exe	cmd.exe
PID 1536 wrote to memory of 1756	1536	blueberry_valorant_external_free.exe	cmd.exe
PID 1536 wrote to memory of 1756	1536	blueberry_valorant_external_free.exe	cmd.exe
PID 1756 wrote to memory of 1764	1756	cmd.exe	iexplore.exe
PID 1756 wrote to memory of 1764	1756	cmd.exe	iexplore.exe
PID 1756 wrote to memory of 1764	1756	cmd.exe	iexplore.exe
PID 1764 wrote to memory of 1396	1764	iexplore.exe	IEXPLORE.EXE
PID 1764 wrote to memory of 1396	1764	iexplore.exe	IEXPLORE.EXE
PID 1764 wrote to memory of 1396	1764	iexplore.exe	IEXPLORE.EXE
PID 1764 wrote to memory of 1396	1764	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\blueberry_valorant_external_free.exe
"C:\Users\Admin\AppData\Local\Temp\blueberry_valorant_external_free.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start https://discord.gg/9Psv9VZMUn
2⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://discord.gg/9Psv9VZMUn
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1764 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-54-0x000000013F6E0000-0x000000014023C000-memory.dmp

Filesize
11.4MB

Download
memory/1536-55-0x000000013F6E0000-0x000000014023C000-memory.dmp

Filesize
11.4MB

Download
memory/1536-56-0x000000013F6E0000-0x000000014023C000-memory.dmp

Filesize
11.4MB

Download
memory/1536-57-0x000000013F6E0000-0x000000014023C000-memory.dmp

Filesize
11.4MB

Download
memory/1536-58-0x000000013F6E0000-0x000000014023C000-memory.dmp

Filesize
11.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads