Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2023, 16:43

General

  • Target

    ebae09af0151622f220b7ee8064888d3.exe

  • Size

    1.7MB

  • MD5

    ebae09af0151622f220b7ee8064888d3

  • SHA1

    6389eee71107af709c1ebb9da83c56f6b85497d6

  • SHA256

    84d08bdfdf8412eb1991c35edc00539d55634d9f994af7bb8830deb103da64a9

  • SHA512

    301132361cc323a4191888ab19ead3a1795aedb5ee46af9c205fdab69dfbeb3abbe4d6578ce263005bf2ee69e932ece8eb067d24450ed30c4ccfbb0a17b83061

  • SSDEEP

    49152:fU6BpvNqcepKVqbwXahdZAD0LcQp/f2RxIfr5:c6neKV0jX2Xa5

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 8 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Executes dropped EXE
    • Maps connected drives based on registry
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    PID:3420
    • C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe
      "C:\Users\Admin\AppData\Local\Temp\ebae09af0151622f220b7ee8064888d3.exe"
      2⤵
      • Maps connected drives based on registry
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Windows\SCBYDL\emPcTW9.exe
        C:/Windows/SCBYDL/emPcTW9.exe /runp2p:C:/Windows/SCBYDL/w2hQBUR.dll
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1464

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SCBYDL\cacca45129260643620919a9e451f8a3

          Filesize

          221KB

          MD5

          23941cd38ad33bd42f149f90d3fd4cc0

          SHA1

          db169b2db5da6590965c48d573a4036fdedce564

          SHA256

          d2eb0c5eff5caa20023871dd779bb6406efda880d8743d27bc2be46d2a854cc8

          SHA512

          67447a26152242b38194e2aab51bbdfd377a2af774a89ce801ac6fc7e15353027859c7edcce3ed3a86268c606a9213f9c9124eede60e1b62171322d3e0c60b2d

        • C:\Windows\SCBYDL\emPcTW9.exe

          Filesize

          162KB

          MD5

          de3d19dde816cca8943d098c861ceb43

          SHA1

          a1365f8840277050e75ab9b6078859dcfd91840b

          SHA256

          412d08e4c7ae96db0a6e252cdd2e592479388b652e3c88b06563a4b2dd3c956e

          SHA512

          cf9586ae84d9eaa8eca90361ab71348d8a6a1b647f32793ec8ee207d001e6b477d3da2eac476c51d457298412976b19215d7e62036baead524fea74d74756497

        • C:\Windows\SCBYDL\emPcTW9.exe

          Filesize

          87KB

          MD5

          6d94f59e751c69a34b63fa1cd818fd93

          SHA1

          9cd28e1e4b0292e6bb7bad2240e3db580f01c06b

          SHA256

          fc434b3493c84a95942d919bb3cf089aee24dae928e55801340f392c1d7b7750

          SHA512

          f87e658ad110c530571605797cce7307f8c5d8f86004d4986d11523ee233671a89597e34c20e7680440428858251b7a877aa753b8c7ca95e4947d789235877e0

        • C:\Windows\SCBYDL\w2hQBUR.dll

          Filesize

          169KB

          MD5

          d5bb07276776da60f878cea5128f20d0

          SHA1

          2d9346b2d6ca0599ab6b994b650fe0a47a992a4a

          SHA256

          a84f4465d022efb5e77089066de6ca04058d892edf6a98e32f3a25b3f1fd17f2

          SHA512

          0a3f306ad7293849a49aef5747594c6a3f5a4ed6e16be6b63fd67a1e59bca10b2dd414059215e8a3773365308404c63c12849464645e337821e002408dc7a159

        • C:\Windows\SCBYDL\w2hQBUR.dll

          Filesize

          113KB

          MD5

          f209c15dbe40df760950815d568ceb41

          SHA1

          99108c048829f3091a56deb6ba0cdd7a9665cda8

          SHA256

          b025eb3b48b85c8596e074adea513ffaf9c84b462aafae47d4a61f3972b936cf

          SHA512

          73120e710501b28e22a6b7e1d060083f0de87176d567eb509ab780438c33487b0f97daccae9fd8228a135d7bf7b7c66f490d636bfd4024feb093b994c790fa3c

        • C:\Windows\SCBYDL\w2hQBUR.dll

          Filesize

          189KB

          MD5

          6cfaacc0bfa820a97654c88d357ce002

          SHA1

          2fa2991b6b2cd6063843b5748d0b7cdf1a42505c

          SHA256

          4ee493d20adb4fa7eb58d0ac5a83a6165094aa97729ca6f14804fee2c4115716

          SHA512

          6a0ccd4ac635d7f9de8cd3b28c56e24716cd66a9b373763a98942ecc8869ddae3f2f399a1fc3ea6c48cbec465c61a0fd14827a85003fbc36f75d7178fc817d6c

        • memory/1464-22-0x00007FF674230000-0x00007FF6742AA000-memory.dmp

          Filesize

          488KB

        • memory/1464-14-0x00007FF674230000-0x00007FF6742AA000-memory.dmp

          Filesize

          488KB

        • memory/1464-12-0x00007FF674230000-0x00007FF6742AA000-memory.dmp

          Filesize

          488KB

        • memory/3420-33-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/3420-35-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/3420-38-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/3420-36-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/3420-19-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/3420-21-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/3420-37-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/3420-27-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/3420-28-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/3420-31-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/3420-29-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/3420-32-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/3420-34-0x0000000002870000-0x00000000028D6000-memory.dmp

          Filesize

          408KB

        • memory/4856-0-0x00000000007E0000-0x0000000000B47000-memory.dmp

          Filesize

          3.4MB

        • memory/4856-5-0x0000000003960000-0x00000000039BB000-memory.dmp

          Filesize

          364KB

        • memory/4856-1-0x00000000007E0000-0x0000000000B47000-memory.dmp

          Filesize

          3.4MB

        • memory/4856-25-0x0000000003960000-0x00000000039BB000-memory.dmp

          Filesize

          364KB

        • memory/4856-6-0x0000000003960000-0x00000000039BB000-memory.dmp

          Filesize

          364KB

        • memory/4856-24-0x00000000007E0000-0x0000000000B47000-memory.dmp

          Filesize

          3.4MB