Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26-04-2024 08:25
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
General
-
Target
loader.exe
-
Size
4.1MB
-
MD5
9ecdc9ed1bea6c226f92d740d43400b9
-
SHA1
b5b5066cd4284733d8c3f3d7de3ca6653091ae10
-
SHA256
60c57f14c2e0e0df0bda16646b21dddceaee0159dafbbb8daba310d4e1b5be6c
-
SHA512
30bc705a2438288e3647d5adfc6119d751823970972b9c6b39a60384a2b7ac261986026b8d1c0b0ca7ee3d7e95363c97b873fdc5fad4096c903cb4e15bf57e43
-
SSDEEP
98304:vnUGAC+hqc8lqvdzw2nsNKYYURyc9JirsN4JzmUPj:PTn2qcUzp6UYeJRCxPj
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
loader.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ loader.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
loader.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion loader.exe -
Processes:
resource yara_rule behavioral1/memory/2340-0-0x000000013F140000-0x000000013FBDF000-memory.dmp themida behavioral1/memory/2340-2-0x000000013F140000-0x000000013FBDF000-memory.dmp themida behavioral1/memory/2340-3-0x000000013F140000-0x000000013FBDF000-memory.dmp themida behavioral1/memory/2340-4-0x000000013F140000-0x000000013FBDF000-memory.dmp themida behavioral1/memory/2340-5-0x000000013F140000-0x000000013FBDF000-memory.dmp themida behavioral1/memory/2340-6-0x000000013F140000-0x000000013FBDF000-memory.dmp themida behavioral1/memory/2340-7-0x000000013F140000-0x000000013FBDF000-memory.dmp themida behavioral1/memory/2340-8-0x000000013F140000-0x000000013FBDF000-memory.dmp themida behavioral1/memory/2340-17-0x000000013F140000-0x000000013FBDF000-memory.dmp themida behavioral1/memory/2340-20-0x000000013F140000-0x000000013FBDF000-memory.dmp themida behavioral1/memory/2340-26-0x000000013F140000-0x000000013FBDF000-memory.dmp themida behavioral1/memory/2340-29-0x000000013F140000-0x000000013FBDF000-memory.dmp themida -
Processes:
loader.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA loader.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
loader.exepid process 2340 loader.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
loader.exepid process 2340 loader.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
loader.exepid process 2340 loader.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
loader.execmd.exedescription pid process target process PID 2340 wrote to memory of 2512 2340 loader.exe cmd.exe PID 2340 wrote to memory of 2512 2340 loader.exe cmd.exe PID 2340 wrote to memory of 2512 2340 loader.exe cmd.exe PID 2512 wrote to memory of 2720 2512 cmd.exe certutil.exe PID 2512 wrote to memory of 2720 2512 cmd.exe certutil.exe PID 2512 wrote to memory of 2720 2512 cmd.exe certutil.exe PID 2512 wrote to memory of 2952 2512 cmd.exe find.exe PID 2512 wrote to memory of 2952 2512 cmd.exe find.exe PID 2512 wrote to memory of 2952 2512 cmd.exe find.exe PID 2512 wrote to memory of 2524 2512 cmd.exe find.exe PID 2512 wrote to memory of 2524 2512 cmd.exe find.exe PID 2512 wrote to memory of 2524 2512 cmd.exe find.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\loader.exe" MD53⤵
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2340-0-0x000000013F140000-0x000000013FBDF000-memory.dmpFilesize
10.6MB
-
memory/2340-1-0x0000000077850000-0x00000000779F9000-memory.dmpFilesize
1.7MB
-
memory/2340-2-0x000000013F140000-0x000000013FBDF000-memory.dmpFilesize
10.6MB
-
memory/2340-3-0x000000013F140000-0x000000013FBDF000-memory.dmpFilesize
10.6MB
-
memory/2340-4-0x000000013F140000-0x000000013FBDF000-memory.dmpFilesize
10.6MB
-
memory/2340-5-0x000000013F140000-0x000000013FBDF000-memory.dmpFilesize
10.6MB
-
memory/2340-6-0x000000013F140000-0x000000013FBDF000-memory.dmpFilesize
10.6MB
-
memory/2340-7-0x000000013F140000-0x000000013FBDF000-memory.dmpFilesize
10.6MB
-
memory/2340-8-0x000000013F140000-0x000000013FBDF000-memory.dmpFilesize
10.6MB
-
memory/2340-17-0x000000013F140000-0x000000013FBDF000-memory.dmpFilesize
10.6MB
-
memory/2340-19-0x0000000077850000-0x00000000779F9000-memory.dmpFilesize
1.7MB
-
memory/2340-20-0x000000013F140000-0x000000013FBDF000-memory.dmpFilesize
10.6MB
-
memory/2340-26-0x000000013F140000-0x000000013FBDF000-memory.dmpFilesize
10.6MB
-
memory/2340-29-0x000000013F140000-0x000000013FBDF000-memory.dmpFilesize
10.6MB