Overview
overview
10Static
static
1Setup.exe
windows10-1703-x64
10data/Engine.dll
windows10-1703-x64
9iconengine...on.dll
windows10-1703-x64
1keygen/mit.dll
windows10-1703-x64
1libEGL.dll
windows10-1703-x64
1libGLESV2.dll
windows10-1703-x64
1libeay32.dll
windows10-1703-x64
1license/backupkey.dll
windows10-1703-x64
1license/genkey.dll
windows10-1703-x64
3platforms/win32.dll
windows10-1703-x64
1platforms/win64.dll
windows10-1703-x64
1Analysis
-
max time kernel
317s -
max time network
1576s -
platform
windows10-1703_x64 -
resource
win10-20240404-de -
resource tags
arch:x64arch:x86image:win10-20240404-delocale:de-deos:windows10-1703-x64systemwindows -
submitted
25/04/2024, 15:26
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10-20240404-de
Behavioral task
behavioral2
Sample
data/Engine.dll
Resource
win10-20240404-de
Behavioral task
behavioral3
Sample
iconengines/qsvgicon.dll
Resource
win10-20240404-de
Behavioral task
behavioral4
Sample
keygen/mit.dll
Resource
win10-20240404-de
Behavioral task
behavioral5
Sample
libEGL.dll
Resource
win10-20240404-de
Behavioral task
behavioral6
Sample
libGLESV2.dll
Resource
win10-20240404-de
Behavioral task
behavioral7
Sample
libeay32.dll
Resource
win10-20240404-de
Behavioral task
behavioral8
Sample
license/backupkey.dll
Resource
win10-20240404-de
Behavioral task
behavioral9
Sample
license/genkey.dll
Resource
win10-20240404-de
Behavioral task
behavioral10
Sample
platforms/win32.dll
Resource
win10-20240404-de
Behavioral task
behavioral11
Sample
platforms/win64.dll
Resource
win10-20240404-de
General
-
Target
data/Engine.dll
-
Size
9.7MB
-
MD5
981021d0a827344dd8ae30a5c17dddcd
-
SHA1
5903cb8fbd21122204ccca5f7a9fafb0321d82a7
-
SHA256
da7a7b458bc36737eda2c3f46a3695eadae083165b5f148d681178d06db57275
-
SHA512
8ea9cfbe52887560d139b5489016a29f21bbf10f374b1c8baa1985c76c9ca75c1efa1dfb5a2b4ea2d7b5f95e62555daddb60da43da5d7cae929f3b8a77faedd7
-
SSDEEP
196608:1Qvv99NGfRoG2BaCZf2AEhsza67TlBe8jEQN6BXraZOdgMU+qc0KM/:aboAgauA0sBv9jBmrTRZrM/
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine rundll32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5088 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5088 rundll32.exe 5088 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3152 wrote to memory of 5088 3152 rundll32.exe 74 PID 3152 wrote to memory of 5088 3152 rundll32.exe 74 PID 3152 wrote to memory of 5088 3152 rundll32.exe 74
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\data\Engine.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\data\Engine.dll,#12⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5088
-