Analysis

  • max time kernel
    122s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2023, 05:08

General

  • Target

    c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe

  • Size

    5.6MB

  • MD5

    0481d5db958410e104c3ec077eeb6b5a

  • SHA1

    2b52d36fa7feed40fd6e27749aa164b48a615f75

  • SHA256

    c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a

  • SHA512

    af6bcd124350e3f669b71c349f31c44fef8b1047ff101638057ea349ea5fe9db518f1a3dcbac1d72a8ce918de0b40c753adc15fbc79558bc41126766ee39b4ed

  • SSDEEP

    98304:ZJ5+K5wCm/oXwzldh+bQeDV/x5szNfedamMhYVnYG:ZD+K6RawpWbQgxSzNfedamrY

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • VMProtect packed file 5 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe
    "C:\Users\Admin\AppData\Local\Temp\c29eb3ea929319a884bb8061faf36e855d93f44ba1362441d5fa34f70613181a.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3028
  • C:\Users\Public\Documents\123\PTvrst.exe
    "C:\Users\Public\Documents\123\PTvrst.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\WINDOWS\DNomb\spolsvt.exe
      C:\WINDOWS\DNomb\spolsvt.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Users\Public\Documents\t\spolsvt.exe
        C:\Users\Public\Documents\t\spolsvt.exe
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Documents\123\PTvrst.exe

    Filesize

    1.2MB

    MD5

    d22cfb5bfaeb1503b12b07e53ef0a149

    SHA1

    8ea2c85e363f551a159fabd65377affed4e417a1

    SHA256

    260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360

    SHA512

    151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45

  • C:\Users\Public\Documents\123\PTvrst.exe

    Filesize

    1.2MB

    MD5

    d22cfb5bfaeb1503b12b07e53ef0a149

    SHA1

    8ea2c85e363f551a159fabd65377affed4e417a1

    SHA256

    260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360

    SHA512

    151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45

  • C:\Users\Public\Documents\t\spolsvt.exe

    Filesize

    16KB

    MD5

    cdce4713e784ae069d73723034a957ff

    SHA1

    9a393a6bab6568f1a774fb753353223f11367e09

    SHA256

    b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8

    SHA512

    0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

  • C:\Users\Public\Documents\t\spolsvt.exe

    Filesize

    16KB

    MD5

    cdce4713e784ae069d73723034a957ff

    SHA1

    9a393a6bab6568f1a774fb753353223f11367e09

    SHA256

    b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8

    SHA512

    0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

  • C:\WINDOWS\DNomb\Mpec.mbt

    Filesize

    488KB

    MD5

    b080a7a33830f264ce71c2d4fc6cbed5

    SHA1

    3e2ac32e40441a059f24cb1bec27c1ef533641ae

    SHA256

    490acedca10ec4e45ca5cc26fcaf49f40358ae3edd413597cecccaab801ff982

    SHA512

    2d424f0901af4d787aaa2f8319de174ef3b386848bca3e72279f567d329afc570007680f54b551f5072c996a7323062ba1aaa3a04a54786dc6791660587f9c6b

  • C:\WINDOWS\DNomb\spolsvt.exe

    Filesize

    9KB

    MD5

    523d5c39f9d8d2375c3df68251fa2249

    SHA1

    d4ed365c44bec9246fc1a65a32a7791792647a10

    SHA256

    20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78

    SHA512

    526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

  • C:\Windows\DNomb\spolsvt.exe

    Filesize

    9KB

    MD5

    523d5c39f9d8d2375c3df68251fa2249

    SHA1

    d4ed365c44bec9246fc1a65a32a7791792647a10

    SHA256

    20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78

    SHA512

    526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

  • \Users\Public\Documents\t\spolsvt.exe

    Filesize

    16KB

    MD5

    cdce4713e784ae069d73723034a957ff

    SHA1

    9a393a6bab6568f1a774fb753353223f11367e09

    SHA256

    b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8

    SHA512

    0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

  • \Windows\DNomb\spolsvt.exe

    Filesize

    9KB

    MD5

    523d5c39f9d8d2375c3df68251fa2249

    SHA1

    d4ed365c44bec9246fc1a65a32a7791792647a10

    SHA256

    20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78

    SHA512

    526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

  • memory/1300-122-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1300-125-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1300-120-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1300-118-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2156-106-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2156-95-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/2156-93-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/2156-91-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/2156-99-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/2156-102-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/2156-105-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/2156-110-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/2512-75-0x0000000004270000-0x0000000004271000-memory.dmp

    Filesize

    4KB

  • memory/2512-90-0x0000000004090000-0x0000000004091000-memory.dmp

    Filesize

    4KB

  • memory/2512-144-0x0000000000400000-0x00000000006A2000-memory.dmp

    Filesize

    2.6MB

  • memory/2512-60-0x0000000000400000-0x00000000006A2000-memory.dmp

    Filesize

    2.6MB

  • memory/2512-63-0x0000000077740000-0x0000000077742000-memory.dmp

    Filesize

    8KB

  • memory/2512-83-0x0000000004380000-0x0000000004381000-memory.dmp

    Filesize

    4KB

  • memory/2512-82-0x0000000004350000-0x0000000004351000-memory.dmp

    Filesize

    4KB

  • memory/2512-81-0x00000000042B0000-0x00000000042B1000-memory.dmp

    Filesize

    4KB

  • memory/2512-80-0x0000000004120000-0x0000000004121000-memory.dmp

    Filesize

    4KB

  • memory/2512-79-0x0000000004080000-0x0000000004081000-memory.dmp

    Filesize

    4KB

  • memory/2512-78-0x0000000004330000-0x0000000004331000-memory.dmp

    Filesize

    4KB

  • memory/2512-77-0x0000000004290000-0x0000000004291000-memory.dmp

    Filesize

    4KB

  • memory/2512-76-0x00000000042C0000-0x00000000042C1000-memory.dmp

    Filesize

    4KB

  • memory/2512-86-0x0000000004370000-0x0000000004371000-memory.dmp

    Filesize

    4KB

  • memory/2512-74-0x00000000040A0000-0x00000000040A1000-memory.dmp

    Filesize

    4KB

  • memory/2512-73-0x00000000040D0000-0x00000000040D1000-memory.dmp

    Filesize

    4KB

  • memory/2512-72-0x00000000042D0000-0x00000000042D2000-memory.dmp

    Filesize

    8KB

  • memory/2512-71-0x00000000040E0000-0x00000000040E1000-memory.dmp

    Filesize

    4KB

  • memory/2512-70-0x00000000042F0000-0x00000000042F1000-memory.dmp

    Filesize

    4KB

  • memory/2512-69-0x0000000004300000-0x0000000004301000-memory.dmp

    Filesize

    4KB

  • memory/2512-68-0x0000000004110000-0x0000000004111000-memory.dmp

    Filesize

    4KB

  • memory/2512-67-0x0000000004280000-0x0000000004281000-memory.dmp

    Filesize

    4KB

  • memory/2512-66-0x00000000040B0000-0x00000000040B1000-memory.dmp

    Filesize

    4KB

  • memory/2512-65-0x0000000004310000-0x0000000004311000-memory.dmp

    Filesize

    4KB

  • memory/2512-84-0x0000000000400000-0x00000000006A2000-memory.dmp

    Filesize

    2.6MB

  • memory/2512-85-0x0000000004320000-0x0000000004321000-memory.dmp

    Filesize

    4KB

  • memory/3028-1-0x0000000000400000-0x0000000000DEC000-memory.dmp

    Filesize

    9.9MB

  • memory/3028-32-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/3028-53-0x0000000000400000-0x0000000000DEC000-memory.dmp

    Filesize

    9.9MB

  • memory/3028-37-0x0000000077750000-0x0000000077751000-memory.dmp

    Filesize

    4KB

  • memory/3028-36-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/3028-34-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/3028-29-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/3028-31-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/3028-26-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/3028-24-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/3028-21-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/3028-6-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/3028-7-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/3028-9-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/3028-11-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/3028-14-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/3028-16-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/3028-19-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/3028-3-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/3028-4-0x0000000000400000-0x0000000000DEC000-memory.dmp

    Filesize

    9.9MB

  • memory/3028-0-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/3028-49-0x0000000000400000-0x0000000000DEC000-memory.dmp

    Filesize

    9.9MB

  • memory/3028-161-0x0000000000400000-0x0000000000DEC000-memory.dmp

    Filesize

    9.9MB