Analysis
-
max time kernel
42s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
27-04-2023 05:53
General
-
Target
innoi-tr.exe
-
Size
3.6MB
-
MD5
f0c59bc9136e4547f44de13c22c9bef7
-
SHA1
51f73360a6cc303652e85523a211cbf665e5bb93
-
SHA256
5a9fbbd8e9bca755d3bb50a1e2a25187e449fe0c179cefa14a2766fbc704e670
-
SHA512
cb56dd085dfcae88a0efc1a9d643936fd5675cdaa0b43a7879099f00a77f35bb825cbb4bfe0d5cfeef7eb0ae76c6e291dc8c803f1af03243d8f50fe87b1c4bd4
-
SSDEEP
98304:WL4+FDm+RF15MSu+IJFqJC8lfJuV0cjiu6l/vZQt:8FDm01aj+iFJAcDhcvZQt
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\innoi-tr.exe"C:\Users\Admin\AppData\Local\Temp\innoi-tr.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 18842⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\d8e4cd4d7623036990b06f0c5257954a\Admin@[email protected]\Software.txtFilesize
4KB
MD50deddb3cd02f97a1b29228e249b3b365
SHA1fecda2c925798a04ad17871124a441dd96ae1730
SHA256f347f9e4d3dd0ce266a5d225c0471e33386c659c6c2425a1b2e625864e538b9b
SHA51223d186926572a79bd7cec17ddfc8dc49e97097636cf34cdbc4a8b3d6b590362635cb41200da96385cbc9da4d255cef65bf5bf2cd964c37c331ef9d1dec50eeb0
-
memory/1728-54-0x00000000012A0000-0x0000000001CC2000-memory.dmpFilesize
10.1MB
-
memory/1728-57-0x00000000012A0000-0x0000000001CC2000-memory.dmpFilesize
10.1MB
-
memory/1728-58-0x00000000012A0000-0x0000000001CC2000-memory.dmpFilesize
10.1MB
-
memory/1728-59-0x0000000005320000-0x0000000005360000-memory.dmpFilesize
256KB
-
memory/1728-61-0x00000000012A0000-0x0000000001CC2000-memory.dmpFilesize
10.1MB
-
memory/1728-141-0x0000000005320000-0x0000000005360000-memory.dmpFilesize
256KB
-
memory/1728-142-0x0000000005320000-0x0000000005360000-memory.dmpFilesize
256KB
-
memory/1728-154-0x0000000005320000-0x0000000005360000-memory.dmpFilesize
256KB
-
memory/1728-157-0x00000000012A0000-0x0000000001CC2000-memory.dmpFilesize
10.1MB