Analysis
-
max time kernel
599s -
max time network
457s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-it -
resource tags
arch:x64arch:x86image:win10v2004-20240611-itlocale:it-itos:windows10-2004-x64systemwindows -
submitted
27/06/2024, 20:04
Behavioral task
behavioral1
Sample
release-1.rar
Resource
win10v2004-20240508-it
windows10-2004-x64
12 signatures
600 seconds
Behavioral task
behavioral2
Sample
release/main/cheat.exe
Resource
win10v2004-20240508-it
windows10-2004-x64
9 signatures
600 seconds
Behavioral task
behavioral3
Sample
release/main/loader.exe
Resource
win10v2004-20240508-it
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral4
Sample
release/map/map.exe
Resource
win10v2004-20240611-it
windows10-2004-x64
13 signatures
600 seconds
Behavioral task
behavioral5
Sample
release/readme.txt
Resource
win10v2004-20240508-it
windows10-2004-x64
1 signatures
600 seconds
General
-
Target
release/map/map.exe
-
Size
3.3MB
-
MD5
a5a681b19458d693464f24f0d22d7b32
-
SHA1
10b9edb6e510ee582815b3779064698ed9e90db8
-
SHA256
04a72e5f734b6d97c78477d82b1bd24d45e47769b98d908920265a01bbde2d37
-
SHA512
e27f08721444474d7f37e45b6636f71cd5e9823ab197b6665f5c48106f8f84ec57bd5f1e953a3c2d0200ae0f9e80b72a261444bea6e828a62cd0b44bf128ab31
-
SSDEEP
98304:GyVbJ5frOxTN0fAptwDUB+psfprlsg/zG3lC:f2JN0fG6wgsxrqQzGVC
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ map.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IfkSoStIiOxWQoILAxvIhLP\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\IfkSoStIiOxWQoILAxvIhLP" map.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion map.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion map.exe -
resource yara_rule behavioral4/memory/4480-0-0x00007FF7A90A0000-0x00007FF7A99B6000-memory.dmp themida behavioral4/memory/4480-2-0x00007FF7A90A0000-0x00007FF7A99B6000-memory.dmp themida behavioral4/memory/4480-3-0x00007FF7A90A0000-0x00007FF7A99B6000-memory.dmp themida behavioral4/memory/4480-4-0x00007FF7A90A0000-0x00007FF7A99B6000-memory.dmp themida behavioral4/memory/4480-5-0x00007FF7A90A0000-0x00007FF7A99B6000-memory.dmp themida behavioral4/memory/4480-8-0x00007FF7A90A0000-0x00007FF7A99B6000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA map.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4480 map.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1948 taskmgr.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4480 map.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeLoadDriverPrivilege 4480 map.exe Token: SeDebugPrivilege 1948 taskmgr.exe Token: SeSystemProfilePrivilege 1948 taskmgr.exe Token: SeCreateGlobalPrivilege 1948 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\release\map\map.exe"C:\Users\Admin\AppData\Local\Temp\release\map\map.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1948