Overview
overview
9Static
static
7release.rar
windows7-x64
3release.rar
windows10-2004-x64
3release/ma...at.exe
windows7-x64
9release/ma...at.exe
windows10-2004-x64
9release/ma...er.exe
windows7-x64
9release/ma...er.exe
windows10-2004-x64
9release/readme.txt
windows7-x64
1release/readme.txt
windows10-2004-x64
1Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 08:19
Behavioral task
behavioral1
Sample
release.rar
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
release.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
release/main/cheat.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
release/main/cheat.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
release/main/loader.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
release/main/loader.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
release/readme.txt
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
release/readme.txt
Resource
win10v2004-20240508-en
General
-
Target
release/main/loader.exe
-
Size
4.1MB
-
MD5
9ecdc9ed1bea6c226f92d740d43400b9
-
SHA1
b5b5066cd4284733d8c3f3d7de3ca6653091ae10
-
SHA256
60c57f14c2e0e0df0bda16646b21dddceaee0159dafbbb8daba310d4e1b5be6c
-
SHA512
30bc705a2438288e3647d5adfc6119d751823970972b9c6b39a60384a2b7ac261986026b8d1c0b0ca7ee3d7e95363c97b873fdc5fad4096c903cb4e15bf57e43
-
SSDEEP
98304:vnUGAC+hqc8lqvdzw2nsNKYYURyc9JirsN4JzmUPj:PTn2qcUzp6UYeJRCxPj
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
loader.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ loader.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
loader.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion loader.exe -
Processes:
resource yara_rule behavioral6/memory/1444-0-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmp themida behavioral6/memory/1444-2-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmp themida behavioral6/memory/1444-3-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmp themida behavioral6/memory/1444-4-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmp themida behavioral6/memory/1444-6-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmp themida behavioral6/memory/1444-7-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmp themida behavioral6/memory/1444-5-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmp themida behavioral6/memory/1444-8-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmp themida behavioral6/memory/1444-9-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmp themida -
Processes:
loader.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA loader.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
loader.exepid process 1444 loader.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
loader.exepid process 1444 loader.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
loader.exepid process 1444 loader.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
loader.execmd.exedescription pid process target process PID 1444 wrote to memory of 2756 1444 loader.exe cmd.exe PID 1444 wrote to memory of 2756 1444 loader.exe cmd.exe PID 2756 wrote to memory of 4692 2756 cmd.exe certutil.exe PID 2756 wrote to memory of 4692 2756 cmd.exe certutil.exe PID 2756 wrote to memory of 608 2756 cmd.exe find.exe PID 2756 wrote to memory of 608 2756 cmd.exe find.exe PID 2756 wrote to memory of 3196 2756 cmd.exe find.exe PID 2756 wrote to memory of 3196 2756 cmd.exe find.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\release\main\loader.exe"C:\Users\Admin\AppData\Local\Temp\release\main\loader.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\release\main\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\release\main\loader.exe" MD53⤵
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1444-0-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmpFilesize
10.6MB
-
memory/1444-1-0x00007FFB03550000-0x00007FFB03552000-memory.dmpFilesize
8KB
-
memory/1444-2-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmpFilesize
10.6MB
-
memory/1444-3-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmpFilesize
10.6MB
-
memory/1444-4-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmpFilesize
10.6MB
-
memory/1444-6-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmpFilesize
10.6MB
-
memory/1444-7-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmpFilesize
10.6MB
-
memory/1444-5-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmpFilesize
10.6MB
-
memory/1444-8-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmpFilesize
10.6MB
-
memory/1444-9-0x00007FF6EF850000-0x00007FF6F02EF000-memory.dmpFilesize
10.6MB