Analysis
-
max time kernel
185s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 23:39
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe
Resource
win7-20231215-en
8 signatures
150 seconds
General
-
Target
SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe
-
Size
4.1MB
-
MD5
9ecdc9ed1bea6c226f92d740d43400b9
-
SHA1
b5b5066cd4284733d8c3f3d7de3ca6653091ae10
-
SHA256
60c57f14c2e0e0df0bda16646b21dddceaee0159dafbbb8daba310d4e1b5be6c
-
SHA512
30bc705a2438288e3647d5adfc6119d751823970972b9c6b39a60384a2b7ac261986026b8d1c0b0ca7ee3d7e95363c97b873fdc5fad4096c903cb4e15bf57e43
-
SSDEEP
98304:vnUGAC+hqc8lqvdzw2nsNKYYURyc9JirsN4JzmUPj:PTn2qcUzp6UYeJRCxPj
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe -
resource yara_rule behavioral1/memory/2196-0-0x000000013F260000-0x000000013FCFF000-memory.dmp themida behavioral1/memory/2196-2-0x000000013F260000-0x000000013FCFF000-memory.dmp themida behavioral1/memory/2196-3-0x000000013F260000-0x000000013FCFF000-memory.dmp themida behavioral1/memory/2196-4-0x000000013F260000-0x000000013FCFF000-memory.dmp themida behavioral1/memory/2196-5-0x000000013F260000-0x000000013FCFF000-memory.dmp themida behavioral1/memory/2196-6-0x000000013F260000-0x000000013FCFF000-memory.dmp themida behavioral1/memory/2196-7-0x000000013F260000-0x000000013FCFF000-memory.dmp themida behavioral1/memory/2196-8-0x000000013F260000-0x000000013FCFF000-memory.dmp themida behavioral1/memory/2196-17-0x000000013F260000-0x000000013FCFF000-memory.dmp themida behavioral1/memory/2196-18-0x000000013F260000-0x000000013FCFF000-memory.dmp themida behavioral1/memory/2196-21-0x000000013F260000-0x000000013FCFF000-memory.dmp themida behavioral1/memory/2196-27-0x000000013F260000-0x000000013FCFF000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2196 SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2196 SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2196 SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2088 2196 SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe 30 PID 2196 wrote to memory of 2088 2196 SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe 30 PID 2196 wrote to memory of 2088 2196 SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe 30 PID 2088 wrote to memory of 2704 2088 cmd.exe 32 PID 2088 wrote to memory of 2704 2088 cmd.exe 32 PID 2088 wrote to memory of 2704 2088 cmd.exe 32 PID 2088 wrote to memory of 2520 2088 cmd.exe 34 PID 2088 wrote to memory of 2520 2088 cmd.exe 34 PID 2088 wrote to memory of 2520 2088 cmd.exe 34 PID 2088 wrote to memory of 1080 2088 cmd.exe 33 PID 2088 wrote to memory of 1080 2088 cmd.exe 33 PID 2088 wrote to memory of 1080 2088 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.22421.19075.exe" MD53⤵PID:2704
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:1080
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:2520
-
-