Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15/03/2024, 07:18
General
-
Target
SecuriteInfo.com.Trojan.MulDrop24.24081.4037.18647.exe
-
Size
15.0MB
-
MD5
b985d74ccba3ed0f00afe786ac80aa26
-
SHA1
25e7caabc7317298745fc890e92fdc69b7d44250
-
SHA256
dc1c64d12202fce25f4c346619517c60134aad6a3dfeb6ec09c913716a9e9907
-
SHA512
fd81949cb129bf021f2048135b4994b9fb83be41b726164af43d4620ab1af55ecb070d24ef54c7eda79f8f255d221d43ef798e3b5fa41c65d0452a530975ec1c
-
SSDEEP
196608:v4Zrv/uL7NJhKX63JWmQYeCMuXhR3Jn98y18qUq9k/IAj4qTNMGB1vlgJGaoGiPZ:v41/udJoX63JLQA33EqUuO4qBgJxiB
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop24.24081.4037.18647.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop24.24081.4037.18647.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
27.2MB
-
Filesize
27.2MB
-
Filesize
27.2MB
-
Filesize
27.2MB
-
Filesize
27.2MB
-
Filesize
27.2MB
-
Filesize
27.2MB
-
Filesize
27.2MB
-
Filesize
1.7MB