Analysis
- max time kernel
140s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
14/02/2024, 10:15
General
- Target 9b6991df22c91c1c27ff393aba19f8e4.exe
- Size 566KB
- Sample240214-mam8csgg72
- SHA256 1557bbabd3d41adb72a0e4d8bbe33781e5005660f5d68f8cb33e7b4c58fa3373
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b6991df22c91c1c27ff393aba19f8e4.exe"C:\Users\Admin\AppData\Local\Temp\9b6991df22c91c1c27ff393aba19f8e4.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n4154\s4154.exe"C:\Users\Admin\AppData\Local\Temp\n4154\s4154.exe" /h 6c84.api.socdn.com /u 5475a1dd-a818-4ddb-ae0b-49f50a000013 /e 13751279 /v "C:\Users\Admin\AppData\Local\Temp\9b6991df22c91c1c27ff393aba19f8e4.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 38162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2568 -ip 25681⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s4154.exe
s4154.exe
s4154.exe
memory/3748-38-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/3748-40-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/3748-16-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/3748-30-0x000000001BA40000-0x000000001BA54000-memory.dmp
memory/3748-33-0x000000001C160000-0x000000001C62E000-memory.dmp
memory/3748-34-0x000000001C6D0000-0x000000001C76C000-memory.dmp
memory/3748-35-0x000000001C860000-0x000000001C8C2000-memory.dmp
memory/3748-36-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/3748-37-0x000000001BA30000-0x000000001BA38000-memory.dmp
memory/3748-14-0x00007FFEBD8E0000-0x00007FFEBE281000-memory.dmp
memory/3748-39-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/3748-15-0x00007FFEBD8E0000-0x00007FFEBE281000-memory.dmp
memory/3748-41-0x00007FFEBD8E0000-0x00007FFEBE281000-memory.dmp
memory/3748-42-0x00007FFEBD8E0000-0x00007FFEBE281000-memory.dmp
memory/3748-43-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/3748-44-0x0000000020040000-0x000000002017C000-memory.dmp
memory/3748-45-0x0000000020690000-0x0000000020B9E000-memory.dmp
memory/3748-46-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/3748-47-0x0000000020FE0000-0x00000000210E0000-memory.dmp
memory/3748-48-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/3748-49-0x0000000020FE0000-0x00000000210E0000-memory.dmp
memory/3748-50-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/3748-52-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/3748-53-0x00007FFEBD8E0000-0x00007FFEBE281000-memory.dmp