Analysis

  • max time kernel
    151s
  • max time network
    172s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 10:11

General

  • Target

    83fd23ee476175c0b0f0a46200598ee4.exe

  • Size

    4.8MB

  • MD5

    83fd23ee476175c0b0f0a46200598ee4

  • SHA1

    988b0ca1261a7810b64df96540766f7f7c56022f

  • SHA256

    3279ee666821ef28cf1776a074111119c97a07ad57a8816437eeac5ff937605e

  • SHA512

    68c911f53b89973bff5b83b6cdc398370e549fb6c823bd7fedee2ae3156f5795270c1ae3a91990ba48bef74f872b8f103ae15a7bbb89f59e16f8b96d2fbe54b5

  • SSDEEP

    98304:QOl58P5ctjoDng8WlyYtWgZDJQ5hE21F/5K2ZM+mUcr4pg+J1RLQ4vfa:QSMokk8qjWy9YhE2zommUcI7hLQ+

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83fd23ee476175c0b0f0a46200598ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\83fd23ee476175c0b0f0a46200598ee4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\235.exe
      "C:\Users\Admin\AppData\Local\Temp\235.exe"
      2⤵
      • Executes dropped EXE
      PID:2776
    • C:\Users\Admin\AppData\Local\Temp\ExtrimHack[11.04.2018].exe
      "C:\Users\Admin\AppData\Local\Temp\ExtrimHack[11.04.2018].exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:2988

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\CabAF25.tmp

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\Local\Temp\ExtrimHack[11.04.2018].exe

          Filesize

          987KB

          MD5

          aca3f223e86e15567b7a866e941e70fa

          SHA1

          c7eac467191e3bab76f1f5d36a004b214ce2b3ce

          SHA256

          56ed9a24187b984e21dc07aab53d563c3473b205b2ec7e9a961531f8d11877af

          SHA512

          dfc6127d56702d0f3171194c0ebc5e11d98360837bf217dc0d47d17aff1c85729b86b2cbebda7dfdd1e153cbcb1a82d06c3aff368dde4246f38af0926a32161a

        • C:\Users\Admin\AppData\Local\Temp\ExtrimHack[11.04.2018].exe

          Filesize

          1.1MB

          MD5

          c39fa7da50869fbc10b5853782b568a0

          SHA1

          51d271a8d5ee9b63cb9daa01684d9439ed2717d8

          SHA256

          b7ccf2ca00efb52ea6eca4fb67f5aea829da67e5526ab2192aa78652d9075541

          SHA512

          253b485ce74eeaeb00eb6bcf236d7666c46ddb81c0f4cc9439f22c66d7e425aa1319e378dc511858c630391463806ee584728f84d5314a59be7091feded08dd5

        • C:\Users\Admin\AppData\Local\Temp\TarAF48.tmp

          Filesize

          171KB

          MD5

          9c0c641c06238516f27941aa1166d427

          SHA1

          64cd549fb8cf014fcd9312aa7a5b023847b6c977

          SHA256

          4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

          SHA512

          936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

        • \Users\Admin\AppData\Local\Temp\235.exe

          Filesize

          455KB

          MD5

          a73ddbba903795042140f10a6dba68b7

          SHA1

          91ef79f8ecf27826064548effb4f37f935130623

          SHA256

          99cb31e7bc0268d8b698945cb1d31554c1aed2eff1e2b398c8a5997617933d60

          SHA512

          3901b898f9ba3ab9821506913f3d0ea3de7995e6f0e03f2c467c8964c13d8138ce5b4531e8954b5275e07497f1ce7a248f29a758bfd9d09f94278462297597b1

        • \Users\Admin\AppData\Local\Temp\ExtrimHack[11.04.2018].exe

          Filesize

          1.0MB

          MD5

          83129d2fd38c810b2812d3bc7e1f47f3

          SHA1

          7788c1e95dd9da2988a62b1eef3400bd74b41870

          SHA256

          cfbd544d0c231330e27f80766d48790b494ab48d5dc9822c1a8dfd618a2127e3

          SHA512

          c98975c947f864687d9a9655b6de02e86bed42e05787794cdac1f8fb4a2eeb71369b6a0c362fd585c487aaeaf81ee0ffa14fcbbcca815e6fe237d5814d7ece19

        • memory/2428-3-0x0000000077A10000-0x0000000077A11000-memory.dmp

          Filesize

          4KB

        • memory/2428-10-0x0000000077A10000-0x0000000077A11000-memory.dmp

          Filesize

          4KB

        • memory/2428-8-0x0000000075F50000-0x0000000075F51000-memory.dmp

          Filesize

          4KB

        • memory/2428-25-0x0000000003590000-0x0000000003B2D000-memory.dmp

          Filesize

          5.6MB

        • memory/2428-0-0x0000000000400000-0x0000000000D43000-memory.dmp

          Filesize

          9.3MB

        • memory/2428-26-0x0000000000400000-0x0000000000D43000-memory.dmp

          Filesize

          9.3MB

        • memory/2428-4-0x0000000000400000-0x0000000000D43000-memory.dmp

          Filesize

          9.3MB

        • memory/2428-1-0x0000000077A10000-0x0000000077A11000-memory.dmp

          Filesize

          4KB

        • memory/2988-37-0x0000000000830000-0x0000000000831000-memory.dmp

          Filesize

          4KB

        • memory/2988-418-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-31-0x0000000000920000-0x0000000000921000-memory.dmp

          Filesize

          4KB

        • memory/2988-34-0x0000000000670000-0x0000000000671000-memory.dmp

          Filesize

          4KB

        • memory/2988-30-0x0000000000970000-0x0000000000971000-memory.dmp

          Filesize

          4KB

        • memory/2988-35-0x0000000000A90000-0x0000000000A91000-memory.dmp

          Filesize

          4KB

        • memory/2988-33-0x0000000000820000-0x0000000000821000-memory.dmp

          Filesize

          4KB

        • memory/2988-36-0x0000000000900000-0x0000000000901000-memory.dmp

          Filesize

          4KB

        • memory/2988-29-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-28-0x0000000077890000-0x0000000077892000-memory.dmp

          Filesize

          8KB

        • memory/2988-27-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-416-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-417-0x0000000000880000-0x0000000000882000-memory.dmp

          Filesize

          8KB

        • memory/2988-32-0x0000000000A80000-0x0000000000A82000-memory.dmp

          Filesize

          8KB

        • memory/2988-419-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-420-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-421-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-422-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-423-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-424-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-425-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-426-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-427-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-428-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-429-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-430-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB

        • memory/2988-431-0x0000000001040000-0x00000000015DD000-memory.dmp

          Filesize

          5.6MB