Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-03-2024 22:14
Static task
static1
Behavioral task
behavioral1
Sample
b087a691094f9fdd25b7b1828ff7d9fb.exe
Resource
win7-20240221-en
General
-
Target
b087a691094f9fdd25b7b1828ff7d9fb.exe
-
Size
4.6MB
-
MD5
b087a691094f9fdd25b7b1828ff7d9fb
-
SHA1
78882a7d0aef6b8b1a190fa50ea82373bf4d3b88
-
SHA256
954eeaefa91f80e80df9cc550c0cc16f52ad063f8ca3494c40ebc5c51ebc635b
-
SHA512
4f4e1e6da8b96b1984ba4f5a378b442c5671940af3c0fbd2102b6ba4ef15259d88f23e2df38770e91f2389dd439c507561dec820ad471b14148a28fc747b3a83
-
SSDEEP
98304:RM3sD4Wo+QeyE5fjBdsc+zm4o6kz5KRVBQAWBxfGU:RM3sD4WSDe8rPkz5KFRu
Malware Config
Extracted
bitrat
1.33
serviceop091.ddns.net:8000
-
communication_password
c4ca4238a0b923820dcc509a6f75849b
-
tor_process
tor
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
b087a691094f9fdd25b7b1828ff7d9fb.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions b087a691094f9fdd25b7b1828ff7d9fb.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
b087a691094f9fdd25b7b1828ff7d9fb.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools b087a691094f9fdd25b7b1828ff7d9fb.exe -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral2/memory/3696-8-0x00000000056B0000-0x00000000056C8000-memory.dmp net_reactor -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
b087a691094f9fdd25b7b1828ff7d9fb.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b087a691094f9fdd25b7b1828ff7d9fb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b087a691094f9fdd25b7b1828ff7d9fb.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b087a691094f9fdd25b7b1828ff7d9fb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation b087a691094f9fdd25b7b1828ff7d9fb.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
b087a691094f9fdd25b7b1828ff7d9fb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum b087a691094f9fdd25b7b1828ff7d9fb.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 b087a691094f9fdd25b7b1828ff7d9fb.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
RegSvcs.exepid process 3656 RegSvcs.exe 3656 RegSvcs.exe 3656 RegSvcs.exe 3656 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b087a691094f9fdd25b7b1828ff7d9fb.exedescription pid process target process PID 3696 set thread context of 3656 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
b087a691094f9fdd25b7b1828ff7d9fb.exepid process 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b087a691094f9fdd25b7b1828ff7d9fb.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe Token: SeShutdownPrivilege 3656 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegSvcs.exepid process 3656 RegSvcs.exe 3656 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
b087a691094f9fdd25b7b1828ff7d9fb.exedescription pid process target process PID 3696 wrote to memory of 2788 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe schtasks.exe PID 3696 wrote to memory of 2788 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe schtasks.exe PID 3696 wrote to memory of 2788 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe schtasks.exe PID 3696 wrote to memory of 1980 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 1980 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 1980 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 3656 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 3656 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 3656 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 3656 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 3656 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 3656 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 3656 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 3656 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 3656 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 3656 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe PID 3696 wrote to memory of 3656 3696 b087a691094f9fdd25b7b1828ff7d9fb.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b087a691094f9fdd25b7b1828ff7d9fb.exe"C:\Users\Admin\AppData\Local\Temp\b087a691094f9fdd25b7b1828ff7d9fb.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tBJkUjvPFcL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp12A8.tmp"2⤵
- Creates scheduled task(s)
PID:2788
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:1980
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5eaf7617f3e597abd2f4a2456a48ddb47
SHA14b02cae7bdae492032f9d1bece3074d749aeffc8
SHA256f2d635463943e0920eab6c7972afbf5aad5e93d825f45c7f7fd6d278447d4c94
SHA51295812eb016e87f0f3d0055ac9fcb7daa889f7646d5cb0b090b373825ad2910346a75b6064315d48f24c19147e6b4bbc355d25c40c6cdefe84a1f372ee893224b