3fdb9286a980ae003aee2b6e208f1835a0ce355b39ef2541c853c8f0138a83a1

General

Target

1cc330cfee95e49b12d5025598262f1c.exe
Size

629KB
MD5

1cc330cfee95e49b12d5025598262f1c
SHA1

5470c408b27c98369f1716fcab6119c2e535b855
SHA256

3fdb9286a980ae003aee2b6e208f1835a0ce355b39ef2541c853c8f0138a83a1
SHA512

63219959919fa1bbbc2e2082cbaca46b1ec37d00b2add5464959f9a50c276dd322df34f640097886df773003bcf6768db2038f3bed5265cbf6ac674d3c83fec3
SSDEEP

12288:pp/AmKP9iv99isjzmYo/yooGqgZf0z5Pl62FyElPOEkgYlL:kP9iVEsjzm3yooJ8fqBdslL

Score

9^/10

evasion

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	1cc330cfee95e49b12d5025598262f1c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1148	1cc330cfee95e49b12d5025598262f1c.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28
PID 1696 wrote to memory of 1148	1696	1cc330cfee95e49b12d5025598262f1c.exe	28

C:\Users\Admin\AppData\Local\Temp\1cc330cfee95e49b12d5025598262f1c.exe
"C:\Users\Admin\AppData\Local\Temp\1cc330cfee95e49b12d5025598262f1c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\1cc330cfee95e49b12d5025598262f1c.exe
  C:\Users\Admin\AppData\Local\Temp\1cc330cfee95e49b12d5025598262f1c.exe
  2⤵
  - Enumerates VirtualBox registry keys
  - Suspicious behavior: EnumeratesProcesses
  PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

Software Discovery

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-29-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-39-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1148-11-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-14-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-4-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-6-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-8-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-26-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-44-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-43-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-17-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-38-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-20-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-35-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-32-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1148-23-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1696-0-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1696-42-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1696-1-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1696-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1696-2-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads