Analysis
-
max time kernel
277s -
max time network
291s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
29-07-2023 04:49
Static task
static1
Behavioral task
behavioral1
Sample
6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe
Resource
win7-20230712-en
General
-
Target
6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe
-
Size
6.2MB
-
MD5
c1bdc48d24699fd1d43938a3f32fa7fd
-
SHA1
08bdc9543146ea0f16d32237cca2c4446f9b3a80
-
SHA256
6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac
-
SHA512
80bf4c3c2f8face2432d0ebee8ae0982efc2e576dd5f0898fdff434927a6ad6079c793e5cd75835e4cfbd9f1ad831882c625e1df89893c69488a469f5e81eecf
-
SSDEEP
196608:OgvS7Syd4AnGKG3ZWQm1f6c2kjWNM69UWr:Pa7HFnGhkd1f6c2kjR6+Wr
Malware Config
Extracted
laplas
http://185.209.161.89
-
api_key
6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ntlhost.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ntlhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ntlhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2096 ntlhost.exe -
Loads dropped DLL 1 IoCs
pid Process 2344 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ntlhost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2344 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe 2096 ntlhost.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 2 Go-http-client/1.1 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2096 2344 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe 28 PID 2344 wrote to memory of 2096 2344 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe 28 PID 2344 wrote to memory of 2096 2344 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe"C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
710.2MB
MD58187aa38e5cde76b882d2dc90031493c
SHA13cc83e2e5ec155bbd6ef5838383f5f439ef43a84
SHA256e37ccd85260f72f1a91ade75eff3f69640376a88dae8ff740fc8613ec16c3f56
SHA512c972ec786d32e3e67e3422f4ef886ebec51b39c35b16cbec85483acdbbb9f523f703c57d1f53b0d9664a5dcf7cb68e5d0d3cef790b714ed2a911533b7c29ccc1
-
Filesize
710.2MB
MD58187aa38e5cde76b882d2dc90031493c
SHA13cc83e2e5ec155bbd6ef5838383f5f439ef43a84
SHA256e37ccd85260f72f1a91ade75eff3f69640376a88dae8ff740fc8613ec16c3f56
SHA512c972ec786d32e3e67e3422f4ef886ebec51b39c35b16cbec85483acdbbb9f523f703c57d1f53b0d9664a5dcf7cb68e5d0d3cef790b714ed2a911533b7c29ccc1