3235c59c8cb7e035f7078f16766a566fd6bcf0e20d7f389e704e1e9084503e99

Analysis

max time kernel
132s
max time network
140s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
31/05/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
data/Engine.dll
Size 9.7MB
Sample240531-ppaa6agh7x
SHA256 da7a7b458bc36737eda2c3f46a3695eadae083165b5f148d681178d06db57275
MD5 981021d0a827344dd8ae30a5c17dddcd
SHA1 5903cb8fbd21122204ccca5f7a9fafb0321d82a7
SHA512 8ea9cfbe52887560d139b5489016a29f21bbf10f374b1c8baa1985c76c9ca75c1efa1dfb5a2b4ea2d7b5f95e62555daddb60da43da5d7cae929f3b8a77faedd7
SSDEEP 196608:1Qvv99NGfRoG2BaCZf2AEhsza67TlBe8jEQN6BXraZOdgMU+qc0KM/:aboAgauA0sBv9jBmrTRZrM/
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rundll32.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	rundll32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
292	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
292	rundll32.exe
292	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 292	3328	rundll32.exe	74
PID 3328 wrote to memory of 292	3328	rundll32.exe	74
PID 3328 wrote to memory of 292	3328	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\Engine.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\Engine.dll,#1
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-0-0x0000000020000000-0x00000000230C3000-memory.dmp

Download

memory/292-1-0x00000000778B4000-0x00000000778B5000-memory.dmp

Download