Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 01:14
Behavioral task
behavioral1
Sample
44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe
Resource
win7-20240220-en
General
-
Target
44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe
-
Size
4.6MB
-
MD5
ee40081ecc9d262a6afb70e92d9092f2
-
SHA1
4a6d1f93c7e2907e985ba305f9a23a1ff1e413c2
-
SHA256
44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d
-
SHA512
2adccb8da71fea68730ecb383231f19deb66f78baafdc524d8bd0bcc182717fcb261da4d526d5d41f73af6e12523597b79264561401ded8d00fc5fd83f3cba85
-
SSDEEP
98304:MPk3K5R2pbvXGlxqUuHGRFz5+0KOArjownIrl:M+mR2ZvYk4RFz5zb
Malware Config
Signatures
-
Detects executables packed with Themida 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2916-23-0x00000000003A0000-0x0000000000B7C000-memory.dmp INDICATOR_EXE_Packed_Themida -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe -
Processes:
resource yara_rule behavioral1/memory/2916-23-0x00000000003A0000-0x0000000000B7C000-memory.dmp themida -
Processes:
44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exepid process 2916 44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2528 2916 WerFault.exe 44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exepid process 2916 44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exedescription pid process target process PID 2916 wrote to memory of 2528 2916 44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe WerFault.exe PID 2916 wrote to memory of 2528 2916 44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe WerFault.exe PID 2916 wrote to memory of 2528 2916 44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe WerFault.exe PID 2916 wrote to memory of 2528 2916 44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe"C:\Users\Admin\AppData\Local\Temp\44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 5802⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2916-0-0x00000000003A0000-0x0000000000B7C000-memory.dmpFilesize
7.9MB
-
memory/2916-1-0x0000000075534000-0x0000000075535000-memory.dmpFilesize
4KB
-
memory/2916-6-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-7-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-5-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-4-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-3-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-2-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-19-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-18-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-17-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-16-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-15-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-14-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-13-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-12-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-11-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-10-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-9-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-8-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB
-
memory/2916-23-0x00000000003A0000-0x0000000000B7C000-memory.dmpFilesize
7.9MB
-
memory/2916-25-0x0000000075534000-0x0000000075535000-memory.dmpFilesize
4KB
-
memory/2916-27-0x0000000075520000-0x0000000075630000-memory.dmpFilesize
1.1MB