Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20-04-2024 02:31
General
-
Target
c3c524cc782fa892b12aa6840615cf1e55f9fd41e09bb7bf60c30acfbc651fba.exe
-
Size
2.4MB
-
MD5
2264205b3448647965c774f6d939f4a3
-
SHA1
6c52e8f804aeca1c3989ca30f738efd5334832f4
-
SHA256
c3c524cc782fa892b12aa6840615cf1e55f9fd41e09bb7bf60c30acfbc651fba
-
SHA512
3734a4766557f928bac7082fced1336cf6d4aa5d3d0e50808a3dcd3de06cb1a2ec562b5fa3ffa7cd2323b7c67aeaf44757da7c7355eec35d5fae17ff441f40af
-
SSDEEP
49152:Sz0TPaUAq+64bc31+SYDbDuWz817zQsxzf0QAM0finTfpYQUJFXms1:SMPot64mcSYD3uWknbd0QZ06nTKQUJln
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 7 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3c524cc782fa892b12aa6840615cf1e55f9fd41e09bb7bf60c30acfbc651fba.exe"C:\Users\Admin\AppData\Local\Temp\c3c524cc782fa892b12aa6840615cf1e55f9fd41e09bb7bf60c30acfbc651fba.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5469a269cb39bbdcd1b0c87ad7f1671d6
SHA1b4a1d87f72284d2cb9c9da6ba630f1bd04f583cf
SHA256348edf909ff64071e76f935aa664ebbc08fb17a5d96434930e573dd1005ff27c
SHA512b74e0b3c573fab6d12ee839ada1e1928cf3b337b9af3604ccb5caf393a5fc1d60229e0338cd0c629260d29f27f57e9578b939a1a0fab67cbb5f0e0d32595e344
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
Filesize
3KB
MD5f0cb331dd4bd92a6ebce45e7cd1cf5ef
SHA1b66ea0c10b08750295f2dc7c170b370402393214
SHA256e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458
SHA5127c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271
-
Filesize
14KB
MD5dab87894fbe35c7008be708a3d45bdee
SHA11159d2d106a1a2525458131013582b01a5807267
SHA25612e30c084e0f07a00e45b9f8c5a1e77991195951ed1b2b391f425ee1d1dc5bb9
SHA5127b6176f112a69b81f13e14f0aa0bc69968c4056ee6a92987250c2dd3297b4258b43dcae3a36aeeac22c6cf1d1919e94873b6c8dd7f2847e735bfe811c83d9147
-
Filesize
4KB
-
Filesize
3.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.4MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
24KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
24KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB