1786d9bdb752a866bba3beaa27f0b6e635e4c6449bcc32105539551758186492

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AntivirusDefender-main/antivirusfalsepositivetest4/antivirusfalsepositivetest4/Resources/blacklotus.exe
Size

2.4MB
MD5

d948d4b6db5d6d6e2e1ba6c0fa4bf008
SHA1

05846d5b1d37ee2d716140de4f4f984cf1e631d1
SHA256

1f43703d2171ab90e98357b6dfdf824417baa191a59419c27fce42cbafdb7ecf
SHA512

fce681b3721eaf87f27b758782095e34665517ea4e0529cf18b32c4d0d5270ec40c8acf296ad2665e60a6e7e0430807f87e01e3a145902c9fea2a3c83100c15d
SSDEEP

49152:AjY216rMHabk161nZDmcQt8O4BY3+lu2OtXED355:k3YdnZDmcQP6YO/OtXEf

Score

9^/10

evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\Registry\Machine\SYSTEM\ControlSet001\Services\VBoxMouse	blacklotus.exe
Key opened	\Registry\Machine\SYSTEM\ControlSet001\Services\VBoxService	blacklotus.exe
Key opened	\Registry\Machine\SYSTEM\ControlSet001\Services\VBoxSF	blacklotus.exe
Key opened	\Registry\Machine\SYSTEM\ControlSet001\Services\VBoxVideo	blacklotus.exe
Key opened	\Registry\Machine\SYSTEM\ControlSet001\Services\VBoxGuest	blacklotus.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\ACPI\RSDT\VBOX__	blacklotus.exe
Key opened	\Registry\Machine\HARDWARE\ACPI\DSDT\VBOX__	blacklotus.exe
Key opened	\Registry\Machine\HARDWARE\ACPI\FADT\VBOX__	blacklotus.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\Registry\Machine\SOFTWARE\Oracle\VirtualBox Guest Additions	blacklotus.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\Registry\Machine\SOFTWARE\VMware, Inc.\VMware Tools	blacklotus.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	blacklotus.exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	blacklotus.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2056	blacklotus.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe
2056	blacklotus.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1196	2056	blacklotus.exe	28
PID 2056 wrote to memory of 1196	2056	blacklotus.exe	28
PID 2056 wrote to memory of 1196	2056	blacklotus.exe	28

C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\antivirusfalsepositivetest4\antivirusfalsepositivetest4\Resources\blacklotus.exe
"C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\antivirusfalsepositivetest4\antivirusfalsepositivetest4\Resources\blacklotus.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks system information in the registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2056 -s 16
  2⤵
  PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-0-0x00000000779B0000-0x0000000077B59000-memory.dmp

Filesize
1.7MB

Download