Resubmissions
14/01/2025, 09:11
250114-k5qwmatndx29/02/2024, 21:21
240229-z7ptnsch3w23/02/2024, 03:45
240223-ea6qpsaf9t1023/02/2024, 02:03
240223-cg4htahg5x10Analysis
- max time kernel
143s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
23/02/2024, 03:45
General
- Target e046c5e3f0ead64c214eaa411189b0001bdc5431f3a942d0e6fff1ba87fadb9f.exe
- Size 4.3MB
- Sample240223-ea6qpsaf9t
- SHA256 e046c5e3f0ead64c214eaa411189b0001bdc5431f3a942d0e6fff1ba87fadb9f
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 1 IoCs
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e046c5e3f0ead64c214eaa411189b0001bdc5431f3a942d0e6fff1ba87fadb9f.exe"C:\Users\Admin\AppData\Local\Temp\e046c5e3f0ead64c214eaa411189b0001bdc5431f3a942d0e6fff1ba87fadb9f.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 7322⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Protect544cd51a.dll
memory/2396-82-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-83-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-84-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-85-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-86-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-87-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-88-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-90-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-92-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-93-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-96-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-98-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-99-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-101-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-76-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-78-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-80-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-74-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2396-72-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-70-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-68-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2396-66-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2672-23-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-60-0x0000000005730000-0x0000000005770000-memory.dmp
memory/2672-29-0x0000000074A30000-0x000000007511E000-memory.dmp
memory/2672-32-0x0000000000D10000-0x00000000015CA000-memory.dmp
memory/2672-33-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-34-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-35-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-36-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-37-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-38-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-39-0x00000000759B0000-0x00000000759F7000-memory.dmp
memory/2672-40-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-41-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-42-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-43-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-44-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-45-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-46-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-47-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-48-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-49-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-50-0x0000000074A30000-0x000000007511E000-memory.dmp
memory/2672-52-0x0000000005730000-0x0000000005770000-memory.dmp
memory/2672-53-0x0000000005A50000-0x0000000005BE2000-memory.dmp
memory/2672-27-0x0000000077A20000-0x0000000077A22000-memory.dmp
memory/2672-58-0x0000000005730000-0x0000000005770000-memory.dmp
memory/2672-59-0x0000000000500000-0x0000000000510000-memory.dmp
memory/2672-61-0x0000000005730000-0x0000000005770000-memory.dmp
memory/2672-62-0x0000000005730000-0x0000000005770000-memory.dmp
memory/2672-28-0x0000000000D10000-0x00000000015CA000-memory.dmp
memory/2672-63-0x0000000005E80000-0x0000000005F80000-memory.dmp
memory/2672-64-0x0000000005730000-0x0000000005770000-memory.dmp
memory/2672-65-0x0000000005730000-0x0000000005770000-memory.dmp
memory/2672-26-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-25-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-0-0x0000000000D10000-0x00000000015CA000-memory.dmp
memory/2672-24-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-22-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-21-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-20-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-19-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-18-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-17-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-16-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-15-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-13-0x00000000759B0000-0x00000000759F7000-memory.dmp
memory/2672-9-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-8-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-7-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-6-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-5-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-4-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-3-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-2-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-1-0x00000000756F0000-0x0000000075800000-memory.dmp
memory/2672-104-0x0000000005730000-0x0000000005770000-memory.dmp
memory/2672-105-0x0000000005730000-0x0000000005770000-memory.dmp
memory/2672-106-0x0000000005730000-0x0000000005770000-memory.dmp
memory/2672-107-0x0000000005E80000-0x0000000005F80000-memory.dmp