General
-
Target
ImageLoggerV5.exe
-
Size
71.4MB
-
Sample
231105-sygclshh99
-
MD5
d85770827a407d958b0d903510015089
-
SHA1
ae1c6f723ff47f132f946f3e3b65db1b60ab8719
-
SHA256
a3b3dff67b8e87a0ff4b6215002168a99e64f6ffec0058dcad0c33314e3df353
-
SHA512
4d7151a50c34cf68c0da6fae0bdcd27d423748604ce4da449fb8a75e8b8f5afce8b8aee68daea64acfd330db2813e7b1293cfa71a3701bdc40272d029e9d83bc
-
SSDEEP
1572864:i2MJqQuZFswSk8IpG7V+VPhqytE7AwyauZtiRW8J7TwGb94V2vWG/eZj+4HQ:iZJqV3swSkB05awyybuvfqEGCwvPW44w
Behavioral task
behavioral1
Sample
ImageLoggerV5.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
ImageLoggerV5.exe
Resource
win10v2004-20231020-en
Malware Config
Targets
-
-
Target
ImageLoggerV5.exe
-
Size
71.4MB
-
MD5
d85770827a407d958b0d903510015089
-
SHA1
ae1c6f723ff47f132f946f3e3b65db1b60ab8719
-
SHA256
a3b3dff67b8e87a0ff4b6215002168a99e64f6ffec0058dcad0c33314e3df353
-
SHA512
4d7151a50c34cf68c0da6fae0bdcd27d423748604ce4da449fb8a75e8b8f5afce8b8aee68daea64acfd330db2813e7b1293cfa71a3701bdc40272d029e9d83bc
-
SSDEEP
1572864:i2MJqQuZFswSk8IpG7V+VPhqytE7AwyauZtiRW8J7TwGb94V2vWG/eZj+4HQ:iZJqV3swSkB05awyybuvfqEGCwvPW44w
-
Enumerates VirtualBox DLL files
-
Blocklisted process makes network request
-
Possible privilege escalation attempt
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Virtualization/Sandbox Evasion
1