Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2023 14:56
Static task
static1
Behavioral task
behavioral1
Sample
2f28772b3cf7328df4f249e872568c2d.exe
Resource
win7-20230712-en
General
-
Target
2f28772b3cf7328df4f249e872568c2d.exe
-
Size
257KB
-
MD5
2f28772b3cf7328df4f249e872568c2d
-
SHA1
dd4d410c55d413c4794eb0c4f60d179613ab6bc0
-
SHA256
f2028b4fb0b43abc5a062bd359622b254dbf0e301f2a8b842d062896ca24692b
-
SHA512
b96de652ed787364696128c6b81643f7c86db350c1f0544c1b0d79f09e68f29c4df751a591cbf6d5aa4de29ced2ad56e9589109142a3d692f654dd1a54d88485
-
SSDEEP
6144:EtvxnwCJczsk0zhh3a+Rpaur08m8mQOw0O:EpV1Jczr+h7L9Q8mYz
Malware Config
Extracted
laplas
http://45.159.189.33
-
api_key
d1a05de376c0be1daa56dfb2715c8a0c5df8a111b8b31decc886df1e48db7c9c
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ JEBKJDAFHJ.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ntlhost.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion JEBKJDAFHJ.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion JEBKJDAFHJ.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ntlhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ntlhost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation 2f28772b3cf7328df4f249e872568c2d.exe -
Executes dropped EXE 2 IoCs
pid Process 3356 JEBKJDAFHJ.exe 384 ntlhost.exe -
Loads dropped DLL 2 IoCs
pid Process 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" JEBKJDAFHJ.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA JEBKJDAFHJ.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ntlhost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3356 JEBKJDAFHJ.exe 384 ntlhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2f28772b3cf7328df4f249e872568c2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2f28772b3cf7328df4f249e872568c2d.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 62 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe 3708 2f28772b3cf7328df4f249e872568c2d.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3708 wrote to memory of 5032 3708 2f28772b3cf7328df4f249e872568c2d.exe 94 PID 3708 wrote to memory of 5032 3708 2f28772b3cf7328df4f249e872568c2d.exe 94 PID 3708 wrote to memory of 5032 3708 2f28772b3cf7328df4f249e872568c2d.exe 94 PID 5032 wrote to memory of 3356 5032 cmd.exe 96 PID 5032 wrote to memory of 3356 5032 cmd.exe 96 PID 3356 wrote to memory of 384 3356 JEBKJDAFHJ.exe 100 PID 3356 wrote to memory of 384 3356 JEBKJDAFHJ.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe"C:\Users\Admin\AppData\Local\Temp\2f28772b3cf7328df4f249e872568c2d.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe"C:\Users\Admin\AppData\Local\Temp\JEBKJDAFHJ.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:384
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
3.2MB
MD5299a2d8412301a6c84f2da3c446943c2
SHA10f4b455e8a8f0fc278a7fe91db90fafaccfe04fc
SHA25651a7a57fe94c2dce32f7125d2c9827e208e38b8f7b57bd5b0b09f188f656e37f
SHA512751a7fa958d96c91e49da893fbf33d4d066dd32f95d10106764064154c11dc9ce7b782e83d96118e0599501974890d311d1d35a34f67843242baffdbdeb6df1a
-
Filesize
3.2MB
MD5299a2d8412301a6c84f2da3c446943c2
SHA10f4b455e8a8f0fc278a7fe91db90fafaccfe04fc
SHA25651a7a57fe94c2dce32f7125d2c9827e208e38b8f7b57bd5b0b09f188f656e37f
SHA512751a7fa958d96c91e49da893fbf33d4d066dd32f95d10106764064154c11dc9ce7b782e83d96118e0599501974890d311d1d35a34f67843242baffdbdeb6df1a
-
Filesize
588.3MB
MD5e43f4bdba85f5917cf24596f4c054ece
SHA163d66c1f5f4fb696c78b354bf7e0739fa2d00eb1
SHA25609263f4bec7256cfe934d3c9b13f852701930bc4d1e7409b0417944f47ea82f1
SHA51279757e1473a2d59af96598db1ad1c8975f66fdf31747e06ff753a2ae13878f36860feb833f63ae040cdc08802cb9e9ca7b722e8e005c84397b7b707261ba9dd4
-
Filesize
723.6MB
MD51b976ee18f4b2e96f6f4aceb1ca7f2a2
SHA12ae263ea9595f2ce5f3b53aa781e45b8d30e946d
SHA2561f9733adc482f53436d6daac028480766ee2d6d9a4d3212b700bbb34923580fa
SHA51255e33040ca37f23f319428b71aa461eb64910068b31782b0628fbaa8dde370036b9e634668af25dd8f8be39c7984710b8dd6daa9b3fc013d93d75d9e2ea07fef
-
Filesize
715.1MB
MD51d690531095636a41379a0b46c2b5805
SHA1cda3809cc0ff876c348503f85e48fa5cfe632768
SHA256422110d6571cb2bb6fe97d8f5e7b5cf931be756573aebf4a28e824ebf254cd40
SHA5126eb420679ba29307801e7eb5e9a740a5ce535dd4e81ea6fcbfb2e2d1e4b88e918d599b6013f93001c0792a61855cde695f056c38d357621a80914399c43bb2ea