General
-
Target
vir.exe
-
Size
311.3MB
-
Sample
240524-v56besde3z
-
MD5
b3bfc1b8071fc021af93a37f4d636a35
-
SHA1
e9223c95098c3691efdee3085ab6e5ea8004a168
-
SHA256
746c46a902c0931edad094b90a90090145d611196e444b24a72df8458b65165b
-
SHA512
9006e22b360b082e1a3bdae3307b857409fac2d57d4b92616456521c6d1ad2ba91f390b0e20d9448502ef4fae8e6dfc8f5aaf41065f43750d3f29830e49b0e73
-
SSDEEP
6291456:62qVJw+odBeWFv1k4R4b0ewZkhT4ofHwJjvZDQPf2tLSkHidHVeVp:Nr+WeSWgfecGT4RjvqP85SAD
Behavioral task
behavioral1
Sample
vir.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Extracted
quasar
1.4.1
romka
jozzu420-51305.portmap.host:51305
0445c342-b551-411c-9b80-cd437437f491
-
encryption_key
E1BF1D99459F04CAF668F054744BC2C514B0A3D6
-
install_name
Romilyaa.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows 10 Boot
-
subdirectory
SubDir
Extracted
lumma
https://employhabragaomlsp.shop/api
https://museumtespaceorsp.shop/api
https://buttockdecarderwiso.shop/api
https://averageaattractiionsl.shop/api
https://femininiespywageg.shop/api
https://stalfbaclcalorieeis.shop/api
https://civilianurinedtsraov.shop/api
https://roomabolishsnifftwk.shop/api
Targets
-
-
Target
vir.exe
-
Size
311.3MB
-
MD5
b3bfc1b8071fc021af93a37f4d636a35
-
SHA1
e9223c95098c3691efdee3085ab6e5ea8004a168
-
SHA256
746c46a902c0931edad094b90a90090145d611196e444b24a72df8458b65165b
-
SHA512
9006e22b360b082e1a3bdae3307b857409fac2d57d4b92616456521c6d1ad2ba91f390b0e20d9448502ef4fae8e6dfc8f5aaf41065f43750d3f29830e49b0e73
-
SSDEEP
6291456:62qVJw+odBeWFv1k4R4b0ewZkhT4ofHwJjvZDQPf2tLSkHidHVeVp:Nr+WeSWgfecGT4RjvqP85SAD
-
Detect Umbral payload
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Quasar payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Modifies boot configuration data using bcdedit
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Registers COM server for autorun
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
1