72b23359c459b85c2ec141c65e5a4207336b28fb9a75734cd0ac8620988a187c | Triage

Sharing

General

Target

RosePrivateTracker.exe
Size

155KB
Sample

231011-g1bdlaec6s
MD5

6afd2e6b7403e88508a33622e0d82764
SHA1

12a7b51e919364bca99948ca4a8f409bdd677c96
SHA256

72b23359c459b85c2ec141c65e5a4207336b28fb9a75734cd0ac8620988a187c
SHA512

022853e97fbfa135cc998d72b55b1edfb308f38a7d1080f9439f945139cfe0b4f257d7e5eb7b6eb6e0b176ff46cbab5839a3e3f354c06671b6976dfe844827c2
SSDEEP

3072:1IU2DNYZcRqKO9l7HXcKL20zHXcKL20WVI0lt/6pMR8ALHXcKL202:1IUTZYO9l7Xc0jXc0WTt/JXc0

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  RosePrivateTracker.exe
- Size
  
  155KB
- MD5
  
  6afd2e6b7403e88508a33622e0d82764
- SHA1
  
  12a7b51e919364bca99948ca4a8f409bdd677c96
- SHA256
  
  72b23359c459b85c2ec141c65e5a4207336b28fb9a75734cd0ac8620988a187c
- SHA512
  
  022853e97fbfa135cc998d72b55b1edfb308f38a7d1080f9439f945139cfe0b4f257d7e5eb7b6eb6e0b176ff46cbab5839a3e3f354c06671b6976dfe844827c2
- SSDEEP
  
  3072:1IU2DNYZcRqKO9l7HXcKL20zHXcKL20WVI0lt/6pMR8ALHXcKL202:1IUTZYO9l7Xc0jXc0WTt/JXc0
Score

9^/10

evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2