0a857b39e37388680b4b0633af3c155af71cd7ea8a6de6877b9f8468f9f4daf1

Analysis

max time kernel
121s
max time network
132s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
23/11/2023, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loaders/Khemical.exe
Size

17.1MB
MD5

1c5062570bed0d31131d663e723c0ef2
SHA1

11376ee168735a01e3f84c9090e253ad5ae24083
SHA256

f0d9133ad845c427ddd8cd45ecae3f8300b34c30ddb090c7f4a6c71c5e2080b9
SHA512

312a090d636d21705b43cfbf26baf7e4a233c4811c640f0d9989192bb2b2e1cb7d6d5a80362234ba3c7c5f6d369de4ba33114d4df5271557f9a75c3098846927
SSDEEP

393216:+WTE6+vTTu6ZxAx6IErzmlTS+iH1hzlDRNsaTlvXuL/zBmh1fr:+++HDZ+6vrMli/XN9lvXg/zovfr

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Khemical.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Khemical.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Khemical.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Khemical.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Khemical.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Khemical.exe

Executes dropped EXE 1 IoCs

pid	Process
1020	Khemical.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Khemical.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Khemical.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\tephpiksxu.ini	Khemical.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2336	Khemical.exe
1020	Khemical.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
2336	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe
1020	Khemical.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2336	Khemical.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1020	2336	Khemical.exe	72
PID 2336 wrote to memory of 1020	2336	Khemical.exe	72

C:\Users\Admin\AppData\Local\Temp\Loaders\Khemical.exe
"C:\Users\Admin\AppData\Local\Temp\Loaders\Khemical.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\Loaders\Khemical.exe
  "C:\Users\Admin\AppData\Local\Temp\Loaders\Khemical.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Loaders\Khemical.exe

Filesize
15.0MB

MD5
b985d74ccba3ed0f00afe786ac80aa26

SHA1
25e7caabc7317298745fc890e92fdc69b7d44250

SHA256
dc1c64d12202fce25f4c346619517c60134aad6a3dfeb6ec09c913716a9e9907

SHA512
fd81949cb129bf021f2048135b4994b9fb83be41b726164af43d4620ab1af55ecb070d24ef54c7eda79f8f255d221d43ef798e3b5fa41c65d0452a530975ec1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Loaders\Khemical.exe

Filesize
15.0MB

MD5
b985d74ccba3ed0f00afe786ac80aa26

SHA1
25e7caabc7317298745fc890e92fdc69b7d44250

SHA256
dc1c64d12202fce25f4c346619517c60134aad6a3dfeb6ec09c913716a9e9907

SHA512
fd81949cb129bf021f2048135b4994b9fb83be41b726164af43d4620ab1af55ecb070d24ef54c7eda79f8f255d221d43ef798e3b5fa41c65d0452a530975ec1c

Download Submit
memory/1020-17-0x00007FFDFBE00000-0x00007FFDFBFDB000-memory.dmp

Filesize
1.9MB

Download
memory/1020-28-0x00007FFDFBE00000-0x00007FFDFBFDB000-memory.dmp

Filesize
1.9MB

Download
memory/1020-25-0x00007FF631D20000-0x00007FF63385C000-memory.dmp

Filesize
27.2MB

Download
memory/1020-24-0x00007FF631D20000-0x00007FF63385C000-memory.dmp

Filesize
27.2MB

Download
memory/1020-23-0x00007FF631D20000-0x00007FF63385C000-memory.dmp

Filesize
27.2MB

Download
memory/1020-22-0x00007FF631D20000-0x00007FF63385C000-memory.dmp

Filesize
27.2MB

Download
memory/1020-21-0x00007FF631D20000-0x00007FF63385C000-memory.dmp

Filesize
27.2MB

Download
memory/1020-20-0x00007FF631D20000-0x00007FF63385C000-memory.dmp

Filesize
27.2MB

Download
memory/1020-19-0x00007FF631D20000-0x00007FF63385C000-memory.dmp

Filesize
27.2MB

Download
memory/1020-18-0x00007FF631D20000-0x00007FF63385C000-memory.dmp

Filesize
27.2MB

Download
memory/2336-6-0x00007FF646410000-0x00007FF648190000-memory.dmp

Filesize
29.5MB

Download
memory/2336-15-0x00007FF646410000-0x00007FF648190000-memory.dmp

Filesize
29.5MB

Download
memory/2336-9-0x00007FF646410000-0x00007FF648190000-memory.dmp

Filesize
29.5MB

Download
memory/2336-8-0x00007FF646410000-0x00007FF648190000-memory.dmp

Filesize
29.5MB

Download
memory/2336-7-0x00007FF646410000-0x00007FF648190000-memory.dmp

Filesize
29.5MB

Download
memory/2336-0-0x00007FFDFBE00000-0x00007FFDFBFDB000-memory.dmp

Filesize
1.9MB

Download
memory/2336-5-0x00007FF646410000-0x00007FF648190000-memory.dmp

Filesize
29.5MB

Download
memory/2336-4-0x00007FF646410000-0x00007FF648190000-memory.dmp

Filesize
29.5MB

Download
memory/2336-3-0x00007FF646410000-0x00007FF648190000-memory.dmp

Filesize
29.5MB

Download
memory/2336-2-0x00007FF646410000-0x00007FF648190000-memory.dmp

Filesize
29.5MB

Download
memory/2336-27-0x00007FFDFBE00000-0x00007FFDFBFDB000-memory.dmp

Filesize
1.9MB

Download
memory/2336-1-0x00007FF646410000-0x00007FF648190000-memory.dmp

Filesize
29.5MB

Download