Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
24-05-2024 11:41
General
-
Target
SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
-
Size
7.3MB
-
MD5
a5891df2ec1f8f0335bc744b24b4d646
-
SHA1
d8aced6d7fd09deb2580990cecd2594c17d75c4d
-
SHA256
92105da09cc48e4f81bdfe124904bef025ee94c8ed8809353b1f19193a8badf3
-
SHA512
eae0d11b4e25ab03a194c9fd0a844559b66e9f34809a34509a61f86b8a02d48193b74b937fdf2857ad473598fb3ec888d8dbf126637750bca46d0e3c7640ffa3
-
SSDEEP
98304:6iqnIOSIVtC+icuty84gK7NcnJygMABQYCFsq1kkkkkkkkkkkkkkkkkkxkkkkkkb:8IpIjut1Bc+naA6YCFVy2A026
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 1 IoCs
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 6 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe"1⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d045421cf5ce6be0cd627fd1c8f61c2f
SHA1357bb81aa7e24254224d47444ea963c7c5e71d59
SHA25681b76143cd5c953953c25b5f1e51b17bf56be211de316894cfdab77dc08cf59c
SHA5129afcd0a6055a14f56e7fed117f736a4b26aaa39fb3e593854b11c2eb91e45191231ef676bd4bd346ca461aff36bcf1a889e5b0b1e466cfb1697a4c073a87e37b
-
C:\Users\Admin\AppData\Local\Temp\Cab2DE6.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar2E65.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
memory/2740-3-0x000007FEFD800000-0x000007FEFD86C000-memory.dmpFilesize
432KB
-
memory/2740-4-0x0000000140000000-0x0000000140DCF000-memory.dmpFilesize
13.8MB
-
memory/2740-5-0x0000000140000000-0x0000000140DCF000-memory.dmpFilesize
13.8MB
-
memory/2740-6-0x0000000140000000-0x0000000140DCF000-memory.dmpFilesize
13.8MB
-
memory/2740-7-0x0000000140000000-0x0000000140DCF000-memory.dmpFilesize
13.8MB
-
memory/2740-0-0x0000000140000000-0x0000000140DCF000-memory.dmpFilesize
13.8MB
-
memory/2740-1-0x000007FEFD813000-0x000007FEFD814000-memory.dmpFilesize
4KB
-
memory/2740-2-0x000007FEFD800000-0x000007FEFD86C000-memory.dmpFilesize
432KB
-
memory/2740-76-0x0000000140000000-0x0000000140DCF000-memory.dmpFilesize
13.8MB
-
memory/2740-77-0x000007FEFD813000-0x000007FEFD814000-memory.dmpFilesize
4KB
-
memory/2740-78-0x000007FEFD800000-0x000007FEFD86C000-memory.dmpFilesize
432KB