90263f5e0ceee73af6ee6ca4dac8e6441c1f5c39607512a954e42887a5a0bb3a

Analysis

max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DriverAssist.exe
Size

14.8MB
MD5

a705d4503c5d46b58f9c62ff101a4493
SHA1

7df14bdda16ecbd268566d812bd43963b7b866b0
SHA256

e71e9ad7ebebc5b65dcd3a5f6e90041aaf31896fb7733c984b6a603b79f721f4
SHA512

ba47a299e9fa9fe781b09c9e8bd78143dca86af239c1525de70a57eef38736fa7e1934314d81618a7340f6f24ba33383f7e388fa5368274e8885bce1134d8960
SSDEEP

196608:eTXEzqkShkYHM6bETH24CIj88o5JvqN2ud4nLKr4RElS9OK:e6qk+M6b224CA88ojvwBqKrD+7

Score

9^/10

agilenet evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

DriverAssist.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ DriverAssist.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DriverAssist.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DriverAssist.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DriverAssist.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DriverAssist.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

DriverAssist.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine DriverAssist.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine	DriverAssist.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral12/memory/1648-1-0x00000000006A0000-0x0000000001574000-memory.dmp	agile_net

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

DriverAssist.exe

pid process

1648 DriverAssist.exe
Loads dropped DLL 1 IoCs

Processes:

DriverAssist.exe

pid process

1648 DriverAssist.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

DriverAssist.exe

pid process

1648 DriverAssist.exe
1648 DriverAssist.exe

pid	process
1648	DriverAssist.exe

pid	process
1648	DriverAssist.exe

pid	process
1648	DriverAssist.exe
1648	DriverAssist.exe

C:\Users\Admin\AppData\Local\Temp\DriverAssist.exe
"C:\Users\Admin\AppData\Local\Temp\DriverAssist.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1648

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5ea9b20c-b9d7-47f3-9170-786e8268f461\AgileDotNetRT.dll
Filesize
1.0MB

MD5
fc8d9889f08bfad2ae22a0431d37611c

SHA1
d0070f64a7729938b8a758a7815c9b12f3b1b47c

SHA256
e2ccfe84f229cb31bf5d4c9c81ff3615006ec0192dace8cb67ef07d614e5071a

SHA512
595a2ed7aba2e381fcddfc7213dec2a18c42e37416fdafa0e247e8a86eb6be1224256c3cf6302c0dad6d920c9310e8f4c2ced7a692f42a66942e865d40f05112

Download Submit
memory/1648-4-0x0000000005F70000-0x0000000006002000-memory.dmp

Filesize
584KB

Download
memory/1648-3-0x0000000006480000-0x0000000006A24000-memory.dmp

Filesize
5.6MB

Download
memory/1648-16-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-17-0x0000000073530000-0x00000000735B9000-memory.dmp

Filesize
548KB

Download
memory/1648-5-0x0000000006010000-0x0000000006076000-memory.dmp

Filesize
408KB

Download
memory/1648-6-0x0000000006080000-0x00000000063D4000-memory.dmp

Filesize
3.3MB

Download
memory/1648-7-0x0000000005ED0000-0x0000000005F1C000-memory.dmp

Filesize
304KB

Download
memory/1648-1-0x00000000006A0000-0x0000000001574000-memory.dmp

Filesize
14.8MB

Download
memory/1648-31-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-2-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/1648-18-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-19-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-20-0x00000000094B0000-0x000000000954C000-memory.dmp

Filesize
624KB

Download
memory/1648-21-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-22-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-30-0x0000000071100000-0x00000000713F1000-memory.dmp

Filesize
2.9MB

Download
memory/1648-14-0x0000000071100000-0x00000000713F1000-memory.dmp

Filesize
2.9MB

Download