Analysis
-
max time kernel
127s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
25-11-2023 16:06
General
-
Target
c189f0fb469d1614cabaf2c7ecad116504f2a89da8c51f371dd28571dc45a13c.exe
-
Size
2.9MB
-
MD5
2f084751d838cb9bfcc8538401245ca6
-
SHA1
6353a9b23d8e4b50e85cd8e352d4f8d33111b9c0
-
SHA256
c189f0fb469d1614cabaf2c7ecad116504f2a89da8c51f371dd28571dc45a13c
-
SHA512
93b8fc0d072f4c162267dcfe9e25e1ec5fe305f4e6e0a87dd84698ded16089430c2bda52129064efdfe22c8ea66566d85e55829837e044459c0fe7e0be55011d
-
SSDEEP
49152:kYBlx1sMDECa1znLjQy0S4gtSWUxWQ44Dhlqk2RYz9/P1WhZvKg8lfa7KVxmi2/B:ZJ1smyLjQrgcWeVT1lqk2RO9/4v78pIb
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c189f0fb469d1614cabaf2c7ecad116504f2a89da8c51f371dd28571dc45a13c.exe"C:\Users\Admin\AppData\Local\Temp\c189f0fb469d1614cabaf2c7ecad116504f2a89da8c51f371dd28571dc45a13c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
-
Filesize
832KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
8.2MB
-
Filesize
6.9MB
-
Filesize
5.0MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
8.2MB
-
Filesize
832KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
8.2MB
-
Filesize
1.8MB
-
Filesize
832KB
-
Filesize
6.9MB