Overview
overview
10Static
static
10sss/Install/Del3.bat
windows7-x64
1sss/Install/Del3.bat
windows10-2004-x64
1sss/Instal...te.bat
windows7-x64
1sss/Instal...te.bat
windows10-2004-x64
1sss/Install/del.bat
windows7-x64
1sss/Install/del.bat
windows10-2004-x64
1sss/Install/smss.exe
windows7-x64
10sss/Install/smss.exe
windows10-2004-x64
10sss/RDPWinst.exe
windows7-x64
1sss/RDPWinst.exe
windows10-2004-x64
1sss/ReaIte...st.exe
windows7-x64
10sss/ReaIte...st.exe
windows10-2004-x64
10sss/ReaIte...tw.exe
windows7-x64
9sss/ReaIte...tw.exe
windows10-2004-x64
9sss/Window...rv.exe
windows7-x64
10sss/Window...rv.exe
windows10-2004-x64
10sss/Window...MD.exe
windows7-x64
1sss/Window...MD.exe
windows10-2004-x64
1sss/Window...le.exe
windows7-x64
1sss/Window...le.exe
windows10-2004-x64
1sss/Window...st.exe
windows7-x64
1sss/Window...st.exe
windows10-2004-x64
1sss/Window...64.sys
windows7-x64
1sss/Window...64.sys
windows10-2004-x64
1sss/Window...dg.exe
windows7-x64
9sss/Window...dg.exe
windows10-2004-x64
9sss/Window...on.bat
windows7-x64
1sss/Window...on.bat
windows10-2004-x64
1Analysis
-
max time kernel
210s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-03-2024 23:04
Behavioral task
behavioral1
Sample
sss/Install/Del3.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
sss/Install/Del3.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
sss/Install/Delete.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
sss/Install/Delete.bat
Resource
win10v2004-20240319-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
sss/Install/del.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
sss/Install/del.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
sss/Install/smss.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
sss/Install/smss.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
sss/RDPWinst.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
sss/RDPWinst.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
sss/ReaItekHD/taskhost.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
sss/ReaItekHD/taskhost.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
sss/ReaItekHD/taskhostw.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral14
Sample
sss/ReaItekHD/taskhostw.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
sss/Windows Tasks Service/winserv.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral16
Sample
sss/Windows Tasks Service/winserv.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
sss/WindowsTask/AMD.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
sss/WindowsTask/AMD.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
sss/WindowsTask/AppModule.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
sss/WindowsTask/AppModule.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
sss/WindowsTask/MicrosoftHost.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
sss/WindowsTask/MicrosoftHost.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
sss/WindowsTask/WinRing0x64.sys
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
sss/WindowsTask/WinRing0x64.sys
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
sss/WindowsTask/audiodg.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral26
Sample
sss/WindowsTask/audiodg.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
sss/WindowsTask/winlogon.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
sss/WindowsTask/winlogon.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
sss/WindowsTask/audiodg.exe
-
Size
7.1MB
-
MD5
bcbb6f2d561ea3b6cd8f3cfc13486b9e
-
SHA1
52bb4b2d2484f4b2caee8acedfed50e7a4e928e6
-
SHA256
31fcc864de2e72799529a54ab9f7881f99d09100d240b71cd833836f404544c0
-
SHA512
4ade8219aefa089f424152cc4cecad0d988265f3004456963ac7975171c7a7b4f913dca54e55efd641cc0974ff3e1af052148b990e885c28a54c258070146d38
-
SSDEEP
98304:uTGpmHej51BpYSFN0jCGdnd879RSTvRICGUQlZabx6+PbVdcfC3EUhJ8n4o:EGsHaFpYSQ3dCRSbRPtQe16+PvcfConJ
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ audiodg.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion audiodg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion audiodg.exe -
resource yara_rule behavioral25/memory/3044-0-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-2-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-3-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-4-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-5-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-6-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-7-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-8-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-9-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-12-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-13-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-14-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-16-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-17-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-18-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-19-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-20-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-21-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-22-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-23-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-24-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-25-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-26-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-27-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-28-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-29-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-30-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-31-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-32-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida behavioral25/memory/3044-33-0x000000013FCA0000-0x0000000140E34000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA audiodg.exe -
AutoIT Executable 28 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral25/memory/3044-3-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-4-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-5-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-6-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-7-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-8-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-9-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-12-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-13-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-14-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-16-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-17-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-18-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-19-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-20-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-21-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-22-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-23-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-24-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-25-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-26-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-27-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-28-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-29-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-30-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-31-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-32-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe behavioral25/memory/3044-33-0x000000013FCA0000-0x0000000140E34000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3044 audiodg.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 audiodg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString audiodg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe 3044 audiodg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sss\WindowsTask\audiodg.exe"C:\Users\Admin\AppData\Local\Temp\sss\WindowsTask\audiodg.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3044