Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 04:03
Static task
static1
Behavioral task
behavioral1
Sample
bcb3d3296392b0470c960d3e6fa2f5365d5be8980b0b824b463d3eb8faaec38d.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
bcb3d3296392b0470c960d3e6fa2f5365d5be8980b0b824b463d3eb8faaec38d.exe
Resource
win10v2004-20240611-en
General
-
Target
bcb3d3296392b0470c960d3e6fa2f5365d5be8980b0b824b463d3eb8faaec38d.exe
-
Size
5.9MB
-
MD5
a44b33c0724312bb2b6a4fd91a7e5daa
-
SHA1
6887ac5b1a7bcf222245892f871e8b8d9a78e8b6
-
SHA256
bcb3d3296392b0470c960d3e6fa2f5365d5be8980b0b824b463d3eb8faaec38d
-
SHA512
0520b6a8a4b703b7d5be5d5f7def76dd858baada1dc7965ec5b517be2e73b25d32bf45ebbcc8396b782c21ce3e7a57bfd870ea15a91bf3576df440f83885956e
-
SSDEEP
98304:Q+QYIwWZpSL/4rDogwdOz4mRbqMUMd5BkB78t:YPwwQ4r58OzRnUbBM
Malware Config
Signatures
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN bcb3d3296392b0470c960d3e6fa2f5365d5be8980b0b824b463d3eb8faaec38d.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1700 bcb3d3296392b0470c960d3e6fa2f5365d5be8980b0b824b463d3eb8faaec38d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcb3d3296392b0470c960d3e6fa2f5365d5be8980b0b824b463d3eb8faaec38d.exe"C:\Users\Admin\AppData\Local\Temp\bcb3d3296392b0470c960d3e6fa2f5365d5be8980b0b824b463d3eb8faaec38d.exe"1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
PID:1700