Resubmissions

23-02-2024 11:52

240223-n18gnafd9v 10

23-02-2024 08:58

240223-kxe46aea3y 10

Analysis

  • max time kernel
    141s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-02-2024 08:58

General

  • Target

    setup.exe

  • Size

    738.0MB

  • MD5

    d6cf8913bbfdbb9900164fb6e057dda7

  • SHA1

    97baef4de047edc648e4a4222db576079080cd66

  • SHA256

    5daa33a756141dac301dc364c1fc538e91cb66a4878719d3a645fd108c6dfa72

  • SHA512

    ff42356169b867e88120b9a2b2dff39282d07beaf8302dd79681ddf414e93ae21ef5030a2af836e0b208b811582ae43507d197d13485135e83cb212708ca8daf

  • SSDEEP

    98304:C/J4w8+uMZh2F0pwIg7ogcSVn1TDifyDJdbgWETcWG/AbO0e+4:C/uXEhQ0pwIhgcSDGWnWte+4

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2176
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    1⤵
      PID:1728
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:848

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\System32\GroupPolicy\gpt.ini

        Filesize

        127B

        MD5

        8ef9853d1881c5fe4d681bfb31282a01

        SHA1

        a05609065520e4b4e553784c566430ad9736f19f

        SHA256

        9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

        SHA512

        5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

      • memory/2176-22-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-8-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-3-0x00007FFDB3130000-0x00007FFDB33F9000-memory.dmp

        Filesize

        2.8MB

      • memory/2176-23-0x00007FFD80000000-0x00007FFD80002000-memory.dmp

        Filesize

        8KB

      • memory/2176-5-0x00007FFDB3130000-0x00007FFDB33F9000-memory.dmp

        Filesize

        2.8MB

      • memory/2176-7-0x00007FFD80030000-0x00007FFD80031000-memory.dmp

        Filesize

        4KB

      • memory/2176-6-0x00007FFDB5410000-0x00007FFDB5605000-memory.dmp

        Filesize

        2.0MB

      • memory/2176-24-0x00007FFDB3130000-0x00007FFDB33F9000-memory.dmp

        Filesize

        2.8MB

      • memory/2176-9-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-10-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-11-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-12-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-1-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-25-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-21-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-0-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-4-0x00007FFDB3130000-0x00007FFDB33F9000-memory.dmp

        Filesize

        2.8MB

      • memory/2176-2-0x00007FFD80000000-0x00007FFD80002000-memory.dmp

        Filesize

        8KB

      • memory/2176-20-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-26-0x00007FFDB5410000-0x00007FFDB5605000-memory.dmp

        Filesize

        2.0MB

      • memory/2176-27-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-28-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-29-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-30-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-31-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-32-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-33-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-34-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-35-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-36-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-37-0x0000000140000000-0x0000000140C54000-memory.dmp

        Filesize

        12.3MB

      • memory/2176-38-0x00007FFDB3130000-0x00007FFDB33F9000-memory.dmp

        Filesize

        2.8MB

      • memory/2176-39-0x00007FFDB5410000-0x00007FFDB5605000-memory.dmp

        Filesize

        2.0MB