Analysis
-
max time kernel
126s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
13-07-2023 14:38
Behavioral task
behavioral1
Sample
VSWQBBUITB.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
VSWQBBUITB.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
qDu.u.exe
Resource
win7-20230712-en
General
-
Target
VSWQBBUITB.dll
-
Size
11.4MB
-
MD5
841d67181966ffd3269b1c18a0850751
-
SHA1
f9edc2a6bc20a6618de97cb825b9314c15e9bb35
-
SHA256
e3520f4fdc7bc4b780dd20a277899682cae0b012eb715d7346f1636e634a52bc
-
SHA512
be697d4bbb9db2030c6be1c5055d4e4f158c6f8a9f51631b319ad849b2250b18bc9fdb4834629eba22bc86e4c4a9e6cf57f827a89a66d509238a608e52980a1f
-
SSDEEP
196608:JF85AYWEhydlfb4YsWtueQgq4VSAyHqewIAkgTZtl+yp+BA+DkBE:7kPWEh+be9544bKewVNsyp+BdkBE
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 2148 rundll32.exe -
resource yara_rule behavioral2/memory/2148-137-0x00000000021C0000-0x0000000003F03000-memory.dmp themida behavioral2/memory/2148-138-0x00000000021C0000-0x0000000003F03000-memory.dmp themida behavioral2/memory/2148-139-0x00000000021C0000-0x0000000003F03000-memory.dmp themida behavioral2/memory/2148-140-0x00000000021C0000-0x0000000003F03000-memory.dmp themida behavioral2/memory/2148-141-0x00000000021C0000-0x0000000003F03000-memory.dmp themida behavioral2/memory/2148-143-0x00000000021C0000-0x0000000003F03000-memory.dmp themida behavioral2/memory/2148-144-0x00000000021C0000-0x0000000003F03000-memory.dmp themida behavioral2/memory/2148-145-0x00000000021C0000-0x0000000003F03000-memory.dmp themida behavioral2/memory/2148-171-0x00000000021C0000-0x0000000003F03000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2148 rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3248 2148 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2148 rundll32.exe 2148 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3992 wrote to memory of 2148 3992 rundll32.exe 85 PID 3992 wrote to memory of 2148 3992 rundll32.exe 85 PID 3992 wrote to memory of 2148 3992 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VSWQBBUITB.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VSWQBBUITB.dll,#12⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2148 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 7403⤵
- Program crash
PID:3248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2148 -ip 21481⤵PID:4088
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5d8f4ab8284f0fda871d6834e24bc6f37
SHA1641948e44a1dcfd0ef68910768eb4b1ea6b49d10
SHA256c09d0790e550694350b94ca6b077c54f983c135fab8990df5a75462804150912
SHA512f65a916041846718306567d33273c3d0f41e0b26589cf6db46ec6c788ba0d87a708c94979d3bd0609142badca9e7129690b92169a07dcf7cd8c66698827d2fa0