Analysis
-
max time kernel
122s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
20/10/2023, 05:08
Behavioral task
behavioral1
Sample
c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe
Resource
win10v2004-20230915-en
General
-
Target
c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe
-
Size
5.6MB
-
MD5
0481d5db958410e104c3ec077eeb6b5a
-
SHA1
2b52d36fa7feed40fd6e27749aa164b48a615f75
-
SHA256
c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a
-
SHA512
af6bcd124350e3f669b71c349f31c44fef8b1047ff101638057ea349ea5fe9db518f1a3dcbac1d72a8ce918de0b40c753adc15fbc79558bc41126766ee39b4ed
-
SSDEEP
98304:ZJ5+K5wCm/oXwzldh+bQeDV/x5szNfedamMhYVnYG:ZD+K6RawpWbQgxSzNfedamrY
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ PTvrst.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 2512 PTvrst.exe 2156 spolsvt.exe 1300 spolsvt.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Wine PTvrst.exe -
Loads dropped DLL 2 IoCs
pid Process 2512 PTvrst.exe 2156 spolsvt.exe -
resource yara_rule behavioral1/memory/3028-1-0x0000000000400000-0x0000000000DEC000-memory.dmp vmprotect behavioral1/memory/3028-4-0x0000000000400000-0x0000000000DEC000-memory.dmp vmprotect behavioral1/memory/3028-49-0x0000000000400000-0x0000000000DEC000-memory.dmp vmprotect behavioral1/memory/3028-53-0x0000000000400000-0x0000000000DEC000-memory.dmp vmprotect behavioral1/memory/3028-161-0x0000000000400000-0x0000000000DEC000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Therecontinuous = "C:\\WINDOWS\\DNomb\\PTvrst.exe" PTvrst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ϵͳ×é¼þ = "C:\\Users\\Public\\Documents\\123\\PTvrst.exe" spolsvt.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2512 PTvrst.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2512 set thread context of 2156 2512 PTvrst.exe 31 PID 2156 set thread context of 1300 2156 spolsvt.exe 32 -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\DNomb\Mpec.mbt c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe File created C:\Windows\DNomb\PTvrst.exe c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe File created C:\Windows\DNomb\spolsvt.exe c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe File created C:\Windows\DNomb\Mpec.mbt c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 spolsvt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz spolsvt.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3028 c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe 3028 c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe 3028 c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe 3028 c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe 3028 c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe 3028 c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe 3028 c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe 3028 c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe 3028 c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe 3028 c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe 2512 PTvrst.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 1300 spolsvt.exe 2156 spolsvt.exe 2156 spolsvt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1300 spolsvt.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3028 c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe 3028 c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe 2512 PTvrst.exe 2512 PTvrst.exe 2156 spolsvt.exe 2156 spolsvt.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2512 wrote to memory of 2156 2512 PTvrst.exe 31 PID 2156 wrote to memory of 1300 2156 spolsvt.exe 32 PID 2156 wrote to memory of 1300 2156 spolsvt.exe 32 PID 2156 wrote to memory of 1300 2156 spolsvt.exe 32 PID 2156 wrote to memory of 1300 2156 spolsvt.exe 32 PID 2156 wrote to memory of 1300 2156 spolsvt.exe 32 PID 2156 wrote to memory of 1300 2156 spolsvt.exe 32 PID 2156 wrote to memory of 1300 2156 spolsvt.exe 32 PID 2156 wrote to memory of 1300 2156 spolsvt.exe 32 PID 2156 wrote to memory of 1300 2156 spolsvt.exe 32 PID 2156 wrote to memory of 1300 2156 spolsvt.exe 32 PID 2156 wrote to memory of 1300 2156 spolsvt.exe 32 PID 2156 wrote to memory of 1300 2156 spolsvt.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe"C:\Users\Admin\AppData\Local\Temp\c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3028
-
C:\Users\Public\Documents\123\PTvrst.exe"C:\Users\Public\Documents\123\PTvrst.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\WINDOWS\DNomb\spolsvt.exeC:\WINDOWS\DNomb\spolsvt.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Public\Documents\t\spolsvt.exeC:\Users\Public\Documents\t\spolsvt.exe3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d22cfb5bfaeb1503b12b07e53ef0a149
SHA18ea2c85e363f551a159fabd65377affed4e417a1
SHA256260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
SHA512151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45
-
Filesize
1.2MB
MD5d22cfb5bfaeb1503b12b07e53ef0a149
SHA18ea2c85e363f551a159fabd65377affed4e417a1
SHA256260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
SHA512151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45
-
Filesize
16KB
MD5cdce4713e784ae069d73723034a957ff
SHA19a393a6bab6568f1a774fb753353223f11367e09
SHA256b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA5120a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
-
Filesize
16KB
MD5cdce4713e784ae069d73723034a957ff
SHA19a393a6bab6568f1a774fb753353223f11367e09
SHA256b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA5120a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
-
Filesize
488KB
MD5b080a7a33830f264ce71c2d4fc6cbed5
SHA13e2ac32e40441a059f24cb1bec27c1ef533641ae
SHA256490acedca10ec4e45ca5cc26fcaf49f40358ae3edd413597cecccaab801ff982
SHA5122d424f0901af4d787aaa2f8319de174ef3b386848bca3e72279f567d329afc570007680f54b551f5072c996a7323062ba1aaa3a04a54786dc6791660587f9c6b
-
Filesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4
-
Filesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4
-
Filesize
16KB
MD5cdce4713e784ae069d73723034a957ff
SHA19a393a6bab6568f1a774fb753353223f11367e09
SHA256b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA5120a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
-
Filesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4