Overview
overview
9Static
static
7release.zip
windows7-x64
1release.zip
windows10-2004-x64
1release.rar
windows7-x64
3release.rar
windows10-2004-x64
7release/ma...at.exe
windows7-x64
9release/ma...at.exe
windows10-2004-x64
9release/ma...er.exe
windows7-x64
9release/ma...er.exe
windows10-2004-x64
9release/map/map.exe
windows7-x64
9release/map/map.exe
windows10-2004-x64
9release/readme.txt
windows7-x64
1release/readme.txt
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 17:04
Behavioral task
behavioral1
Sample
release.zip
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
release.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
release.rar
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
release.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
release/main/cheat.exe
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
release/main/cheat.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
release/main/loader.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
release/main/loader.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
release/map/map.exe
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
release/map/map.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
release/readme.txt
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
release/readme.txt
Resource
win10v2004-20240508-en
General
-
Target
release/main/loader.exe
-
Size
4.1MB
-
MD5
9ecdc9ed1bea6c226f92d740d43400b9
-
SHA1
b5b5066cd4284733d8c3f3d7de3ca6653091ae10
-
SHA256
60c57f14c2e0e0df0bda16646b21dddceaee0159dafbbb8daba310d4e1b5be6c
-
SHA512
30bc705a2438288e3647d5adfc6119d751823970972b9c6b39a60384a2b7ac261986026b8d1c0b0ca7ee3d7e95363c97b873fdc5fad4096c903cb4e15bf57e43
-
SSDEEP
98304:vnUGAC+hqc8lqvdzw2nsNKYYURyc9JirsN4JzmUPj:PTn2qcUzp6UYeJRCxPj
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
loader.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ loader.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
loader.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion loader.exe -
Processes:
resource yara_rule behavioral7/memory/1608-0-0x000000013F530000-0x000000013FFCF000-memory.dmp themida behavioral7/memory/1608-2-0x000000013F530000-0x000000013FFCF000-memory.dmp themida behavioral7/memory/1608-4-0x000000013F530000-0x000000013FFCF000-memory.dmp themida behavioral7/memory/1608-3-0x000000013F530000-0x000000013FFCF000-memory.dmp themida behavioral7/memory/1608-6-0x000000013F530000-0x000000013FFCF000-memory.dmp themida behavioral7/memory/1608-7-0x000000013F530000-0x000000013FFCF000-memory.dmp themida behavioral7/memory/1608-5-0x000000013F530000-0x000000013FFCF000-memory.dmp themida behavioral7/memory/1608-8-0x000000013F530000-0x000000013FFCF000-memory.dmp themida behavioral7/memory/1608-17-0x000000013F530000-0x000000013FFCF000-memory.dmp themida behavioral7/memory/1608-18-0x000000013F530000-0x000000013FFCF000-memory.dmp themida behavioral7/memory/1608-25-0x000000013F530000-0x000000013FFCF000-memory.dmp themida behavioral7/memory/1608-27-0x000000013F530000-0x000000013FFCF000-memory.dmp themida -
Processes:
loader.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA loader.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
loader.exepid process 1608 loader.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
loader.exepid process 1608 loader.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
loader.execmd.exedescription pid process target process PID 1608 wrote to memory of 2876 1608 loader.exe cmd.exe PID 1608 wrote to memory of 2876 1608 loader.exe cmd.exe PID 1608 wrote to memory of 2876 1608 loader.exe cmd.exe PID 2876 wrote to memory of 2712 2876 cmd.exe certutil.exe PID 2876 wrote to memory of 2712 2876 cmd.exe certutil.exe PID 2876 wrote to memory of 2712 2876 cmd.exe certutil.exe PID 2876 wrote to memory of 2592 2876 cmd.exe find.exe PID 2876 wrote to memory of 2592 2876 cmd.exe find.exe PID 2876 wrote to memory of 2592 2876 cmd.exe find.exe PID 2876 wrote to memory of 2756 2876 cmd.exe find.exe PID 2876 wrote to memory of 2756 2876 cmd.exe find.exe PID 2876 wrote to memory of 2756 2876 cmd.exe find.exe PID 1608 wrote to memory of 2516 1608 loader.exe WerFault.exe PID 1608 wrote to memory of 2516 1608 loader.exe WerFault.exe PID 1608 wrote to memory of 2516 1608 loader.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\release\main\loader.exe"C:\Users\Admin\AppData\Local\Temp\release\main\loader.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\release\main\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\release\main\loader.exe" MD53⤵PID:2712
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:2592
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:2756
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1608 -s 15562⤵PID:2516