Analysis
-
max time kernel
192s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 22:52
General
-
Target
OverWolf Crypter.zip
-
Size
36.5MB
-
MD5
a116a6efbffd9b698bdf8774332ac8f1
-
SHA1
33d11b996329060d35d758e10389beb69567685e
-
SHA256
0e98adba7adbbcb6071be545eeb269fec2bff9300cd8bd48c91f076ae5103dae
-
SHA512
001ecae34b7d337479d0ec780abd3f3dcd6171ea2df23d195d40969cb0f740af0a6022c43e015360e38a2e8e51264b19548d22376c1e5a5cb273604611b5fbb9
-
SSDEEP
786432:AqQEiVcxNIl1uw0tHyQ+X+eFPL3M0Tr1SEyFyLx7I:A3EbHmQ+O67MMrAE6yLx7I
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
resource yara_rule behavioral1/memory/2312-24-0x0000000000360000-0x0000000002F76000-memory.dmp family_zgrat_v1 behavioral1/memory/2312-25-0x0000000000360000-0x0000000002F76000-memory.dmp family_zgrat_v1 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ OverWolf Crypter 1.1.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion OverWolf Crypter 1.1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion OverWolf Crypter 1.1.exe -
Loads dropped DLL 1 IoCs
pid Process 2312 OverWolf Crypter 1.1.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral1/memory/2312-48-0x0000000008800000-0x0000000008A4C000-memory.dmp agile_net -
resource yara_rule behavioral1/memory/2312-24-0x0000000000360000-0x0000000002F76000-memory.dmp themida behavioral1/memory/2312-25-0x0000000000360000-0x0000000002F76000-memory.dmp themida -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2312 OverWolf Crypter 1.1.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2312 OverWolf Crypter 1.1.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2864 taskmgr.exe Token: SeSystemProfilePrivilege 2864 taskmgr.exe Token: SeCreateGlobalPrivilege 2864 taskmgr.exe Token: SeDebugPrivilege 2312 OverWolf Crypter 1.1.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2312 OverWolf Crypter 1.1.exe 2312 OverWolf Crypter 1.1.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2312 wrote to memory of 4752 2312 OverWolf Crypter 1.1.exe 110 PID 2312 wrote to memory of 4752 2312 OverWolf Crypter 1.1.exe 110
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\OverWolf Crypter.zip"1⤵PID:1932
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:1956
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1972
-
C:\Users\Admin\Desktop\OverWolf Crypter\OverWolf Crypter 1.1.exe"C:\Users\Admin\Desktop\OverWolf Crypter\OverWolf Crypter 1.1.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\Desktop\OverWolf Crypter\ILMerge.exe"C:\Users\Admin\Desktop\OverWolf Crypter\ILMerge.exe"2⤵PID:4752
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD59af5eb006bb0bab7f226272d82c896c7
SHA1c2a5bb42a5f08f4dc821be374b700652262308f0
SHA25677dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
SHA5127badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a