Analysis
- max time kernel
140s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
08/01/2024, 04:23
General
- Target 4a6df1f89cb44aec4b1680aac49227bf.exe
- Size 1.9MB
- Sample240108-ez24tabaar
- SHA256 8c1d915f3abfbebf499a1c1ce2178d93c0386066fc701a6151b883445d9d7309
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a6df1f89cb44aec4b1680aac49227bf.exe"C:\Users\Admin\AppData\Local\Temp\4a6df1f89cb44aec4b1680aac49227bf.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mkill.bat" "2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
mkill.bat
memory/3892-11-0x0000000005120000-0x0000000005121000-memory.dmp
memory/3892-8-0x00000000050D0000-0x00000000050D2000-memory.dmp
memory/3892-16-0x0000000005200000-0x0000000005201000-memory.dmp
memory/3892-15-0x0000000005150000-0x0000000005151000-memory.dmp
memory/3892-14-0x00000000050E0000-0x00000000050E1000-memory.dmp
memory/3892-13-0x00000000051A0000-0x00000000051A1000-memory.dmp
memory/3892-12-0x0000000005160000-0x0000000005161000-memory.dmp
memory/3892-0-0x0000000000AB0000-0x0000000000FA6000-memory.dmp
memory/3892-17-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/3892-10-0x0000000005170000-0x0000000005171000-memory.dmp
memory/3892-9-0x0000000005140000-0x0000000005141000-memory.dmp
memory/3892-7-0x00000000050F0000-0x00000000050F1000-memory.dmp
memory/3892-6-0x0000000005100000-0x0000000005101000-memory.dmp
memory/3892-5-0x0000000005130000-0x0000000005131000-memory.dmp
memory/3892-4-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/3892-3-0x0000000000AB0000-0x0000000000FA6000-memory.dmp
memory/3892-20-0x0000000000AB0000-0x0000000000FA6000-memory.dmp
memory/3892-1-0x00000000775B4000-0x00000000775B6000-memory.dmp