Malware Analysis Report

2024-10-19 01:10

Sample ID 230730-3a1fpabf77
Target 223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e
SHA256 223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e
Tags
themida laplas redline 300723_rc clipper evasion infostealer persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e

Threat Level: Known bad

The file 223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e was found to be: Known bad.

Malicious Activity Summary

themida laplas redline 300723_rc clipper evasion infostealer persistence spyware stealer trojan

Detects DLL dropped by Raspberry Robin.

Laplas Clipper

RedLine

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Loads dropped DLL

Themida packer

Checks BIOS information in registry

Executes dropped EXE

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

GoLang User-Agent

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-30 23:19

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-30 23:19

Reported

2023-07-30 23:24

Platform

win7-20230712-en

Max time kernel

276s

Max time network

287s

Command Line

"C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe"

Signatures

Detects DLL dropped by Raspberry Robin.

Description Indicator Process Target
N/A N/A N/A N/A

Laplas Clipper

stealer clipper laplas

RedLine

infostealer redline

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\Notepod.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\Notepod.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\Notepod.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Notepod.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Notepod.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\Notepod.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\Notepod.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2636 set thread context of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2636 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2636 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2636 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2636 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2636 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2636 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2636 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2636 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2636 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2636 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2636 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2636 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2980 wrote to memory of 988 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Users\Admin\AppData\Local\Temp\Notepod.exe
PID 2980 wrote to memory of 988 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Users\Admin\AppData\Local\Temp\Notepod.exe
PID 2980 wrote to memory of 988 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Users\Admin\AppData\Local\Temp\Notepod.exe
PID 2980 wrote to memory of 988 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Users\Admin\AppData\Local\Temp\Notepod.exe
PID 988 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\Notepod.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 988 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\Notepod.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 988 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\Notepod.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe

"C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\Notepod.exe

"C:\Users\Admin\AppData\Local\Temp\Notepod.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 rc3007.tuktuk.ug udp
NL 85.209.3.9:11290 rc3007.tuktuk.ug tcp
NL 45.66.230.149:80 45.66.230.149 tcp
US 8.8.8.8:53 lpls.tuktuk.ug udp
NL 45.66.230.149:80 lpls.tuktuk.ug tcp

Files

memory/2636-54-0x0000000000F60000-0x0000000001604000-memory.dmp

memory/2636-55-0x0000000075030000-0x0000000075140000-memory.dmp

memory/2636-56-0x0000000075030000-0x0000000075140000-memory.dmp

memory/2636-58-0x0000000076B60000-0x0000000076BA7000-memory.dmp

memory/2636-60-0x0000000075030000-0x0000000075140000-memory.dmp

memory/2636-62-0x0000000075030000-0x0000000075140000-memory.dmp

memory/2636-63-0x00000000775C0000-0x00000000775C2000-memory.dmp

memory/2636-64-0x0000000075030000-0x0000000075140000-memory.dmp

memory/2636-65-0x0000000075030000-0x0000000075140000-memory.dmp

memory/2636-66-0x0000000000F60000-0x0000000001604000-memory.dmp

memory/2636-68-0x0000000076B60000-0x0000000076BA7000-memory.dmp

memory/2636-69-0x0000000075030000-0x0000000075140000-memory.dmp

memory/2636-70-0x0000000075030000-0x0000000075140000-memory.dmp

memory/2636-71-0x0000000075030000-0x0000000075140000-memory.dmp

memory/2636-72-0x0000000075030000-0x0000000075140000-memory.dmp

memory/2636-73-0x0000000075030000-0x0000000075140000-memory.dmp

memory/2636-74-0x00000000002D0000-0x00000000002EC000-memory.dmp

memory/2636-75-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2636-76-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2636-78-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2636-80-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2636-82-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2636-84-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2636-86-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2636-88-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2636-90-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2636-92-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2636-94-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2636-96-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2636-98-0x00000000002D0000-0x00000000002E5000-memory.dmp

memory/2980-99-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2980-100-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2980-101-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2980-102-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2980-103-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2980-104-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2980-106-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2980-108-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2636-110-0x0000000075030000-0x0000000075140000-memory.dmp

memory/2636-111-0x0000000076B60000-0x0000000076BA7000-memory.dmp

memory/2980-112-0x00000000003B0000-0x00000000003B6000-memory.dmp

memory/2636-113-0x0000000000F60000-0x0000000001604000-memory.dmp

memory/2980-114-0x0000000074610000-0x0000000074CFE000-memory.dmp

memory/2980-115-0x00000000004D0000-0x0000000000510000-memory.dmp

memory/2980-116-0x0000000074610000-0x0000000074CFE000-memory.dmp

memory/2980-117-0x00000000004D0000-0x0000000000510000-memory.dmp

\Users\Admin\AppData\Local\Temp\Notepod.exe

MD5 b30e29bccabab032c27910210d9ccf76
SHA1 caa3927738b66c3ecc553943eabedcbbfbe4c0da
SHA256 b6e2f26fea81267dc7b39b4f919083c8c8be5ff233a5c3acca6e1339d5bb21e2
SHA512 ce8348d0547de624b1bf19804c87b1e0379d29c5fe585d0ac602f51dd1bab90649654b87ebd236eef593829757d182ae16facbd5c2710bfecc87837c63a495a8

C:\Users\Admin\AppData\Local\Temp\Notepod.exe

MD5 b30e29bccabab032c27910210d9ccf76
SHA1 caa3927738b66c3ecc553943eabedcbbfbe4c0da
SHA256 b6e2f26fea81267dc7b39b4f919083c8c8be5ff233a5c3acca6e1339d5bb21e2
SHA512 ce8348d0547de624b1bf19804c87b1e0379d29c5fe585d0ac602f51dd1bab90649654b87ebd236eef593829757d182ae16facbd5c2710bfecc87837c63a495a8

memory/2980-123-0x000000000BF60000-0x000000000C7FB000-memory.dmp

memory/988-124-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/2980-125-0x0000000074610000-0x0000000074CFE000-memory.dmp

memory/988-126-0x00000000773D0000-0x0000000077579000-memory.dmp

memory/988-127-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/988-128-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/988-129-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/988-130-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/988-131-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/988-132-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/988-133-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/988-134-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/988-135-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/988-136-0x0000000001010000-0x00000000018AB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Notepod.exe

MD5 b30e29bccabab032c27910210d9ccf76
SHA1 caa3927738b66c3ecc553943eabedcbbfbe4c0da
SHA256 b6e2f26fea81267dc7b39b4f919083c8c8be5ff233a5c3acca6e1339d5bb21e2
SHA512 ce8348d0547de624b1bf19804c87b1e0379d29c5fe585d0ac602f51dd1bab90649654b87ebd236eef593829757d182ae16facbd5c2710bfecc87837c63a495a8

memory/988-138-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/988-139-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/988-140-0x00000000773D0000-0x0000000077579000-memory.dmp

\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 0a56cc6f5a6214db21e504f27c26cb9c
SHA1 cfd262b4dca501fc6936d2f10d3529e1d0b10e09
SHA256 eae46b93dbc67f48f588834dfa4547557644debffd676dccacc91de83cf494f7
SHA512 1ce1baa1b25e8bce4956182a2b0ad68235ce6de474e61f565b17fe6c71315873e0f2e5e0a37be6ce187fc096948c93ee16d8c1dd08e24aab1ccf0bb9bd99ef0d

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 0a56cc6f5a6214db21e504f27c26cb9c
SHA1 cfd262b4dca501fc6936d2f10d3529e1d0b10e09
SHA256 eae46b93dbc67f48f588834dfa4547557644debffd676dccacc91de83cf494f7
SHA512 1ce1baa1b25e8bce4956182a2b0ad68235ce6de474e61f565b17fe6c71315873e0f2e5e0a37be6ce187fc096948c93ee16d8c1dd08e24aab1ccf0bb9bd99ef0d

memory/988-144-0x0000000028850000-0x00000000290EB000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 0a56cc6f5a6214db21e504f27c26cb9c
SHA1 cfd262b4dca501fc6936d2f10d3529e1d0b10e09
SHA256 eae46b93dbc67f48f588834dfa4547557644debffd676dccacc91de83cf494f7
SHA512 1ce1baa1b25e8bce4956182a2b0ad68235ce6de474e61f565b17fe6c71315873e0f2e5e0a37be6ce187fc096948c93ee16d8c1dd08e24aab1ccf0bb9bd99ef0d

memory/1036-147-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/988-146-0x0000000001010000-0x00000000018AB000-memory.dmp

memory/988-148-0x00000000773D0000-0x0000000077579000-memory.dmp

memory/1036-149-0x00000000773D0000-0x0000000077579000-memory.dmp

memory/1036-150-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-151-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-152-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-153-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-154-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-155-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-156-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-157-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-158-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-159-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-160-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-161-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-162-0x00000000773D0000-0x0000000077579000-memory.dmp

memory/1036-163-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-164-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-165-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-166-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-167-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-168-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-171-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-172-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-173-0x0000000000D50000-0x00000000015EB000-memory.dmp

memory/1036-174-0x0000000000D50000-0x00000000015EB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-07-30 23:19

Reported

2023-07-30 23:24

Platform

win10-20230703-en

Max time kernel

124s

Max time network

256s

Command Line

"C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe"

Signatures

Detects DLL dropped by Raspberry Robin.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 972 set thread context of 4124 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 972 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 972 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 972 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 972 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 972 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 972 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 972 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 972 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe

"C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rc3007.tuktuk.ug udp
NL 85.209.3.9:11290 rc3007.tuktuk.ug tcp
US 8.8.8.8:53 9.3.209.85.in-addr.arpa udp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 9.57.101.20.in-addr.arpa udp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp

Files

memory/972-122-0x0000000000980000-0x0000000001024000-memory.dmp

memory/972-123-0x00000000755A0000-0x0000000075762000-memory.dmp

memory/972-124-0x00000000755A0000-0x0000000075762000-memory.dmp

memory/972-125-0x00000000755A0000-0x0000000075762000-memory.dmp

memory/972-126-0x0000000075770000-0x0000000075840000-memory.dmp

memory/972-130-0x0000000000980000-0x0000000001024000-memory.dmp

memory/972-131-0x0000000005980000-0x0000000005A1C000-memory.dmp

memory/972-132-0x0000000000980000-0x0000000001024000-memory.dmp

memory/972-133-0x00000000755A0000-0x0000000075762000-memory.dmp

memory/972-135-0x0000000075770000-0x0000000075840000-memory.dmp

memory/972-136-0x00000000058F0000-0x000000000590C000-memory.dmp

memory/972-137-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/972-138-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/972-140-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/972-142-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/972-144-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/972-146-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/972-148-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/972-150-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/972-152-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/972-154-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/972-156-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/972-158-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/972-160-0x00000000058F0000-0x0000000005905000-memory.dmp

memory/4124-161-0x0000000000400000-0x0000000000430000-memory.dmp

memory/972-167-0x0000000000980000-0x0000000001024000-memory.dmp

memory/972-168-0x00000000755A0000-0x0000000075762000-memory.dmp

memory/4124-170-0x0000000073220000-0x000000007390E000-memory.dmp

memory/4124-169-0x00000000068F0000-0x00000000068F6000-memory.dmp

memory/972-171-0x0000000075770000-0x0000000075840000-memory.dmp

memory/4124-172-0x0000000009610000-0x0000000009C16000-memory.dmp

memory/4124-173-0x0000000009110000-0x000000000921A000-memory.dmp

memory/4124-174-0x0000000008FF0000-0x0000000009000000-memory.dmp

memory/4124-175-0x0000000008F50000-0x0000000008F62000-memory.dmp

memory/4124-176-0x0000000008FB0000-0x0000000008FEE000-memory.dmp

memory/4124-177-0x0000000009000000-0x000000000904B000-memory.dmp

memory/4124-182-0x00000000092E0000-0x0000000009356000-memory.dmp

memory/4124-183-0x0000000009400000-0x0000000009492000-memory.dmp

memory/4124-184-0x000000000A630000-0x000000000AB2E000-memory.dmp

memory/4124-187-0x00000000094A0000-0x0000000009506000-memory.dmp

memory/4124-194-0x0000000073220000-0x000000007390E000-memory.dmp

memory/4124-197-0x000000000A400000-0x000000000A5C2000-memory.dmp

memory/4124-198-0x000000000C380000-0x000000000C8AC000-memory.dmp

memory/4124-313-0x0000000008FF0000-0x0000000009000000-memory.dmp

memory/4124-580-0x0000000073220000-0x000000007390E000-memory.dmp