Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
19-07-2024 23:06
General
-
Target
Creed All Spoofer/Creed.exe
-
Size
22.8MB
-
MD5
0ede063d189d5176683244c62cb160a7
-
SHA1
9a1aedd08f3bb29390cce31a5d16eaa8681c6089
-
SHA256
499ec15d37c4816953ea43ef49043143341cde6b95ba447d1791c40f80f6b5b9
-
SHA512
acb404002ac791e906f32ad4290984edafee899748ac0b924a838d20107b9e7c3b64631b7ea83e3592d174e6a92434922aa6a1832a7fb9cb5d8ac8f762609bb0
-
SSDEEP
393216:r67Ft/tiAuJOzzZRFMCcCLVzSordVGGtdmaD3U38UfXkOuthQnjs84GFmQClq23m:r67Ft/tiAuJOzzZRFMCcCLVzSordVGGs
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
Themida packer 12 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Creed All Spoofer\Creed.exe"C:\Users\Admin\AppData\Local\Temp\Creed All Spoofer\Creed.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD5a704e95e819bb0b0b94dbe2c83ae7c55
SHA1b4d2c9789412b832ec3cc8a1a1fee2f05c755a5b
SHA256b88ef71de206b869b221d9eaba826a7805304bbd7d833aa745c480f8b05293a4
SHA512e88bb55149b1659d495acaf426adeaa7e0ec5978896c8d434686fb436b107811e1a8eda21252ee0dc21693e167c8dc40212038d17037f182cfe509bbe7a7db0a
-
Filesize
342B
MD559fed645b850d79642cd1ce63e0d4a27
SHA13fb251d857359769a24a4509527a6cf00cdeb375
SHA256ff96ec0400b4405202cf98bcd9efc5202fc5b175c88fe8311d6ff22f142e120d
SHA512e2dc34567bac004cfc25a0714e5634491e628f8b598555b6e772799697dac1a9b72b5c6bd61ef1b44fb054cd571b7d0f115d58975a81eeadad59c276ecb8086b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
4.2MB
MD505b012457488a95a05d0541e0470d392
SHA174f541d6a8365508c794ef7b4ac7c297457f9ce3
SHA2561f77a0749ac730500f203b8c4d072587923ac679e184a3859aeb855c2a2e7d8d
SHA5126d6e7b838d4425d49ac8d3738135374ef5357f0677b07cecb7afbf5feddc1997bf6dce68d48787eff8a74c4728def8880c8f01842eda35b5815fb561fa401ae6
-
Filesize
80KB
-
Filesize
11.5MB
-
Filesize
1.2MB
-
Filesize
9.9MB
-
Filesize
11.5MB
-
Filesize
9.9MB
-
Filesize
22.8MB
-
Filesize
592KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
40KB
-
Filesize
2.9MB
-
Filesize
11.5MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
11.5MB
-
Filesize
9.9MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB