gcleaner | 298882eef447afb08c134245d29d689feb30431a4c8595da619f2038f6d8b615

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-81807878-2351072935-4259904108-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 15 IoCs

pid	Process
364	VEcn9M2wB4mqAHRRZOA1uTW4.exe
1640	kaGXd2638zH0GGnMhtE1tsnN.exe
788	dG5jyYNIc_SIxjEoHJPyFW43.exe
912	O92MiVwjUOguE8OLYjd7qHR0.exe
4488	uYq1CHPoBcClG0Z8H3aktXLX.exe
440	Goqd7IMXxTC1zrIU0ol5PfFV.exe
4352	_FD63gP4GKvyn21LpP78HlWG.exe
3020	KoG4owpwSCC_V_xlUHSt2pPU.exe
868	cmj0Sjft137R85qMMO6K19Xu.exe
3672	Qnh0iT99mtDQNQZi7DSsOOYt.exe
2580	JgvRMUrPmLq6egO7Fhupwvvi.exe
316	hYMGZGqLWOExgrgD39QJ1F63.exe
3780	5EY83NmcM8gxBJwjVgkflbGP.exe
1284	VhJ_saWBZDACZWm3FihU24KK.exe
600	ASTHFvixGDN542SpLbd5ou2T.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 24 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral5/memory/4720-0-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/memory/4720-5-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/memory/4720-7-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/memory/4720-8-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/memory/4720-9-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/memory/4720-10-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/memory/4720-11-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/memory/4720-12-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/memory/4720-21-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/memory/4720-22-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/memory/4720-24-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/memory/4720-230-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/files/0x000700000001ac65-256.dat	themida
behavioral5/memory/1640-279-0x0000000000E00000-0x00000000013CB000-memory.dmp	themida
behavioral5/memory/1640-322-0x0000000000E00000-0x00000000013CB000-memory.dmp	themida
behavioral5/memory/1640-345-0x0000000000E00000-0x00000000013CB000-memory.dmp	themida
behavioral5/memory/1640-367-0x0000000000E00000-0x00000000013CB000-memory.dmp	themida
behavioral5/memory/4720-379-0x00007FF7719C0000-0x00007FF772224000-memory.dmp	themida
behavioral5/memory/1640-386-0x0000000000E00000-0x00000000013CB000-memory.dmp	themida
behavioral5/memory/1640-428-0x0000000000E00000-0x00000000013CB000-memory.dmp	themida
behavioral5/memory/1640-380-0x0000000000E00000-0x00000000013CB000-memory.dmp	themida
behavioral5/memory/1640-474-0x0000000000E00000-0x00000000013CB000-memory.dmp	themida
behavioral5/memory/1640-313-0x0000000000E00000-0x00000000013CB000-memory.dmp	themida
behavioral5/memory/1640-310-0x0000000000E00000-0x00000000013CB000-memory.dmp	themida

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral5/files/0x000700000001ac64-261.dat	vmprotect
behavioral5/memory/912-374-0x0000000000270000-0x0000000000B5E000-memory.dmp	vmprotect
behavioral5/memory/912-467-0x0000000000270000-0x0000000000B5E000-memory.dmp	vmprotect
behavioral5/memory/912-514-0x0000000000270000-0x0000000000B5E000-memory.dmp	vmprotect

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
32	bitbucket.org
50	bitbucket.org
68	bitbucket.org
157	iplogger.org
158	iplogger.org
25	bitbucket.org

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.myip.com
7	api.myip.com
8	ipinfo.io
9	ipinfo.io
168	api.myip.com
169	ipinfo.io
170	ipinfo.io
180	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4720	setup.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4060	sc.exe
3104	sc.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5032	868	WerFault.exe	86
2660	868	WerFault.exe	86
1932	868	WerFault.exe	86

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4104	schtasks.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 364	4720	setup.exe	79
PID 4720 wrote to memory of 364	4720	setup.exe	79
PID 4720 wrote to memory of 364	4720	setup.exe	79
PID 4720 wrote to memory of 600	4720	setup.exe	77
PID 4720 wrote to memory of 600	4720	setup.exe	77
PID 4720 wrote to memory of 600	4720	setup.exe	77
PID 4720 wrote to memory of 1284	4720	setup.exe	90
PID 4720 wrote to memory of 1284	4720	setup.exe	90
PID 4720 wrote to memory of 1284	4720	setup.exe	90
PID 4720 wrote to memory of 868	4720	setup.exe	86
PID 4720 wrote to memory of 868	4720	setup.exe	86
PID 4720 wrote to memory of 868	4720	setup.exe	86
PID 4720 wrote to memory of 2580	4720	setup.exe	88
PID 4720 wrote to memory of 2580	4720	setup.exe	88
PID 4720 wrote to memory of 2580	4720	setup.exe	88
PID 4720 wrote to memory of 3020	4720	setup.exe	84
PID 4720 wrote to memory of 3020	4720	setup.exe	84
PID 4720 wrote to memory of 3020	4720	setup.exe	84
PID 4720 wrote to memory of 316	4720	setup.exe	89
PID 4720 wrote to memory of 316	4720	setup.exe	89
PID 4720 wrote to memory of 316	4720	setup.exe	89
PID 4720 wrote to memory of 3672	4720	setup.exe	87
PID 4720 wrote to memory of 3672	4720	setup.exe	87
PID 4720 wrote to memory of 3672	4720	setup.exe	87
PID 4720 wrote to memory of 3780	4720	setup.exe	91
PID 4720 wrote to memory of 3780	4720	setup.exe	91
PID 4720 wrote to memory of 3780	4720	setup.exe	91
PID 4720 wrote to memory of 1640	4720	setup.exe	80
PID 4720 wrote to memory of 1640	4720	setup.exe	80
PID 4720 wrote to memory of 1640	4720	setup.exe	80
PID 4720 wrote to memory of 4488	4720	setup.exe	85
PID 4720 wrote to memory of 4488	4720	setup.exe	85
PID 4720 wrote to memory of 4488	4720	setup.exe	85
PID 4720 wrote to memory of 912	4720	setup.exe	81
PID 4720 wrote to memory of 912	4720	setup.exe	81
PID 4720 wrote to memory of 912	4720	setup.exe	81
PID 4720 wrote to memory of 788	4720	setup.exe	82
PID 4720 wrote to memory of 788	4720	setup.exe	82
PID 4720 wrote to memory of 788	4720	setup.exe	82
PID 4720 wrote to memory of 440	4720	setup.exe	83
PID 4720 wrote to memory of 440	4720	setup.exe	83
PID 4720 wrote to memory of 440	4720	setup.exe	83
PID 4720 wrote to memory of 4352	4720	setup.exe	78
PID 4720 wrote to memory of 4352	4720	setup.exe	78

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\Documents\SimpleAdobe\ASTHFvixGDN542SpLbd5ou2T.exe
  C:\Users\Admin\Documents\SimpleAdobe\ASTHFvixGDN542SpLbd5ou2T.exe
  2⤵
  - Executes dropped EXE
  PID:600
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    PID:1524
- C:\Users\Admin\Documents\SimpleAdobe\_FD63gP4GKvyn21LpP78HlWG.exe
  C:\Users\Admin\Documents\SimpleAdobe\_FD63gP4GKvyn21LpP78HlWG.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    PID:1920
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:4968
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    PID:4196
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    PID:3800
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "OBGPQMHF"
    3⤵
    - Launches sc.exe
    PID:3104
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4060
- C:\Users\Admin\Documents\SimpleAdobe\VEcn9M2wB4mqAHRRZOA1uTW4.exe
  C:\Users\Admin\Documents\SimpleAdobe\VEcn9M2wB4mqAHRRZOA1uTW4.exe
  2⤵
  - Executes dropped EXE
  PID:364
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3120
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2192
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3472
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1132
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4092
- C:\Users\Admin\Documents\SimpleAdobe\kaGXd2638zH0GGnMhtE1tsnN.exe
  C:\Users\Admin\Documents\SimpleAdobe\kaGXd2638zH0GGnMhtE1tsnN.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Users\Admin\Documents\SimpleAdobe\O92MiVwjUOguE8OLYjd7qHR0.exe
  C:\Users\Admin\Documents\SimpleAdobe\O92MiVwjUOguE8OLYjd7qHR0.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Users\Admin\Documents\SimpleAdobe\dG5jyYNIc_SIxjEoHJPyFW43.exe
  C:\Users\Admin\Documents\SimpleAdobe\dG5jyYNIc_SIxjEoHJPyFW43.exe
  2⤵
  - Executes dropped EXE
  PID:788
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3180
- C:\Users\Admin\Documents\SimpleAdobe\Goqd7IMXxTC1zrIU0ol5PfFV.exe
  C:\Users\Admin\Documents\SimpleAdobe\Goqd7IMXxTC1zrIU0ol5PfFV.exe
  2⤵
  - Executes dropped EXE
  PID:440
- - C:\Users\Admin\AppData\Local\Temp\7zS559D.tmp\Install.exe
    .\Install.exe /IExpbdidepGR "525403" /S
    3⤵
    PID:1064
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
      4⤵
      PID:3332
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bXvtwaJkKQEzfXjvnG" /SC once /ST 18:51:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\IvFVVHNigIyhAiWaa\EDHrMUSPJvyJNvL\taAXpFY.exe\" Mv /drsite_idRSm 525403 /S" /V1 /F
      4⤵
      Creates scheduled task(s)
      PID:4104
- C:\Users\Admin\Documents\SimpleAdobe\KoG4owpwSCC_V_xlUHSt2pPU.exe
  C:\Users\Admin\Documents\SimpleAdobe\KoG4owpwSCC_V_xlUHSt2pPU.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Users\Admin\Documents\SimpleAdobe\uYq1CHPoBcClG0Z8H3aktXLX.exe
  C:\Users\Admin\Documents\SimpleAdobe\uYq1CHPoBcClG0Z8H3aktXLX.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4324
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:208
- C:\Users\Admin\Documents\SimpleAdobe\cmj0Sjft137R85qMMO6K19Xu.exe
  C:\Users\Admin\Documents\SimpleAdobe\cmj0Sjft137R85qMMO6K19Xu.exe
  2⤵
  - Executes dropped EXE
  PID:868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 768
    3⤵
    - Program crash
    PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 824
    3⤵
    - Program crash
    PID:2660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 848
    3⤵
    - Program crash
    PID:1932
- C:\Users\Admin\Documents\SimpleAdobe\Qnh0iT99mtDQNQZi7DSsOOYt.exe
  C:\Users\Admin\Documents\SimpleAdobe\Qnh0iT99mtDQNQZi7DSsOOYt.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Users\Admin\Documents\SimpleAdobe\JgvRMUrPmLq6egO7Fhupwvvi.exe
  C:\Users\Admin\Documents\SimpleAdobe\JgvRMUrPmLq6egO7Fhupwvvi.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Users\Admin\Documents\SimpleAdobe\hYMGZGqLWOExgrgD39QJ1F63.exe
  C:\Users\Admin\Documents\SimpleAdobe\hYMGZGqLWOExgrgD39QJ1F63.exe
  2⤵
  - Executes dropped EXE
  PID:316
- - C:\Users\Admin\AppData\Local\Temp\is-QLDTB.tmp\is-T2A8F.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-QLDTB.tmp\is-T2A8F.tmp" /SL4 $40152 "C:\Users\Admin\Documents\SimpleAdobe\hYMGZGqLWOExgrgD39QJ1F63.exe" 4119408 52224
    3⤵
    PID:2680
  - - C:\Users\Admin\AppData\Local\Three Kingsoft Video\threekingsoftvideo.exe
      "C:\Users\Admin\AppData\Local\Three Kingsoft Video\threekingsoftvideo.exe" -i
      4⤵
      PID:708
  - - C:\Users\Admin\AppData\Local\Three Kingsoft Video\threekingsoftvideo.exe
      "C:\Users\Admin\AppData\Local\Three Kingsoft Video\threekingsoftvideo.exe" -s
      4⤵
      PID:3840
- C:\Users\Admin\Documents\SimpleAdobe\VhJ_saWBZDACZWm3FihU24KK.exe
  C:\Users\Admin\Documents\SimpleAdobe\VhJ_saWBZDACZWm3FihU24KK.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Users\Admin\Documents\SimpleAdobe\5EY83NmcM8gxBJwjVgkflbGP.exe
  C:\Users\Admin\Documents\SimpleAdobe\5EY83NmcM8gxBJwjVgkflbGP.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2992

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:3856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2332

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery