Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/08/2024, 11:48
General
-
Target
Loader (1).exe
-
Size
19.4MB
-
MD5
b0e9695947a18901349ca0dd41521f01
-
SHA1
24dcad88b3a36e1ce145ba769702b00a2ea82738
-
SHA256
eecc62ff3146dfefda210a2b171e8cadccd3fae591664d14f6c1050f2276e4bd
-
SHA512
fe0793394c85845e75a852dbb65898f97659b09c340068d954235e4fc98909ff09b1a0adac17ddac03d5b9262b815af2d27a06af5892198220e1eacced159108
-
SSDEEP
393216:gDI5Bw8g+wwmMQYx16YTnxoOmkEYYe5HVOvNMuPNCEBbRVOqzW:wI5BwDwZQYxxoGpVOvuuPNCcNVQ
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader (1).exe"C:\Users\Admin\AppData\Local\Temp\Loader (1).exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\RepairReceive.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD593294a49d4b822f9e521e099deae3c5b
SHA1ef1c47b61019d58ce6c3d6819efcdb9d4f768f97
SHA256d6451ea2a42d426cb042b2953feb1d77720204448124226275970ce5c566aa79
SHA512306e18437946ad980a50b0b1957a8fd30609667a93848f175aad80acc073374edaeb8ef22414bccde35126048ddc69f6f7f9be1cc6e68461e1a1e503d48016bc
-
Filesize
2.8MB
-
Filesize
51.3MB
-
Filesize
51.3MB
-
Filesize
292KB
-
Filesize
51.3MB
-
Filesize
292KB
-
Filesize
448KB
-
Filesize
51.3MB
-
Filesize
51.3MB
-
Filesize
51.3MB
-
Filesize
51.3MB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
51.3MB
-
Filesize
51.3MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.8MB