Analysis
- max time kernel
120s - max time network
124s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
08/01/2024, 04:23
General
- Target 4a6df1f89cb44aec4b1680aac49227bf.exe
- Size 1.9MB
- Sample240108-ez24tabaar
- SHA256 8c1d915f3abfbebf499a1c1ce2178d93c0386066fc701a6151b883445d9d7309
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a6df1f89cb44aec4b1680aac49227bf.exe"C:\Users\Admin\AppData\Local\Temp\4a6df1f89cb44aec4b1680aac49227bf.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\mkill.bat" "2⤵
- Deletes itself
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
mkill.bat
memory/1912-12-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/1912-10-0x0000000002920000-0x0000000002921000-memory.dmp
memory/1912-19-0x0000000002A90000-0x0000000002A91000-memory.dmp
memory/1912-18-0x0000000002DD0000-0x0000000002DD1000-memory.dmp
memory/1912-17-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/1912-16-0x00000000008B0000-0x00000000008B1000-memory.dmp
memory/1912-15-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
memory/1912-14-0x0000000002DE0000-0x0000000002DE1000-memory.dmp
memory/1912-13-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/1912-0-0x0000000000DB0000-0x00000000012A6000-memory.dmp
memory/1912-3-0x0000000000DB0000-0x00000000012A6000-memory.dmp
memory/1912-9-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
memory/1912-11-0x0000000000D90000-0x0000000000D91000-memory.dmp
memory/1912-8-0x0000000002980000-0x0000000002981000-memory.dmp
memory/1912-7-0x0000000000940000-0x0000000000942000-memory.dmp
memory/1912-6-0x0000000000DA0000-0x0000000000DA1000-memory.dmp
memory/1912-5-0x0000000002970000-0x0000000002971000-memory.dmp
memory/1912-4-0x0000000000920000-0x0000000000921000-memory.dmp
memory/1912-28-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/1912-1-0x0000000077660000-0x0000000077662000-memory.dmp
memory/1912-27-0x0000000000DB0000-0x00000000012A6000-memory.dmp