Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24-01-2024 00:32
Behavioral task
behavioral1
Sample
70f6d008869f17c3e7a0331102af159b.exe
Resource
win7-20231215-en
General
-
Target
70f6d008869f17c3e7a0331102af159b.exe
-
Size
3.2MB
-
MD5
70f6d008869f17c3e7a0331102af159b
-
SHA1
e22527ec22fd44d25e31a32c0048f09494de7581
-
SHA256
ad7a74ddae7cc81d8610ab6bedb94857f38c03b795c4a612fbacc47941286709
-
SHA512
9f81b856d0e477c03bfe34581316661d79c1b8d34f1c69033b93be9e638d42653caca94ee38384b4cd889ee26a9b2bcbea9b0e1fbb5fb5a9f2b1cc6e34072c36
-
SSDEEP
49152:nZOi6qmoiGguu1bzMKmkwGYU7n5qLwAO+PCEMSOvkJgaEYotide9O5m9x4lPytUp:ZSXuuNZwRU7UnZrOv8gvqOMRdgUr
Malware Config
Extracted
cryptbot
bundky32.top
morfug03.top
-
payload_url
http://tobhay04.top/download.php?file=lv.exe
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
70f6d008869f17c3e7a0331102af159b.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 70f6d008869f17c3e7a0331102af159b.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
70f6d008869f17c3e7a0331102af159b.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 70f6d008869f17c3e7a0331102af159b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 70f6d008869f17c3e7a0331102af159b.exe -
Processes:
resource yara_rule behavioral1/memory/816-0-0x0000000000AF0000-0x00000000012DC000-memory.dmp themida behavioral1/memory/816-2-0x0000000000AF0000-0x00000000012DC000-memory.dmp themida behavioral1/memory/816-3-0x0000000000AF0000-0x00000000012DC000-memory.dmp themida behavioral1/memory/816-4-0x0000000000AF0000-0x00000000012DC000-memory.dmp themida behavioral1/memory/816-5-0x0000000000AF0000-0x00000000012DC000-memory.dmp themida behavioral1/memory/816-6-0x0000000000AF0000-0x00000000012DC000-memory.dmp themida behavioral1/memory/816-7-0x0000000000AF0000-0x00000000012DC000-memory.dmp themida behavioral1/memory/816-8-0x0000000000AF0000-0x00000000012DC000-memory.dmp themida behavioral1/memory/816-11-0x0000000000AF0000-0x00000000012DC000-memory.dmp themida behavioral1/memory/816-13-0x0000000000AF0000-0x00000000012DC000-memory.dmp themida -
Processes:
70f6d008869f17c3e7a0331102af159b.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 70f6d008869f17c3e7a0331102af159b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
70f6d008869f17c3e7a0331102af159b.exepid process 816 70f6d008869f17c3e7a0331102af159b.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
70f6d008869f17c3e7a0331102af159b.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 70f6d008869f17c3e7a0331102af159b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 70f6d008869f17c3e7a0331102af159b.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
70f6d008869f17c3e7a0331102af159b.exepid process 816 70f6d008869f17c3e7a0331102af159b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70f6d008869f17c3e7a0331102af159b.exe"C:\Users\Admin\AppData\Local\Temp\70f6d008869f17c3e7a0331102af159b.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:816