3c4da1db936b6a740a0701f364ccd3a5d2bcc5f3a8a934a10e68f13e829476ec

Resubmissions

05/09/2024, 02:25

240905-cwq62a1fkl 9

05/09/2024, 02:09

240905-clafja1drk 9

Analysis

max time kernel
15s
max time network
17s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
05/09/2024, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

12.5MB
MD5

06ab7010e847a1c3a567c1f9e14452bd
SHA1

593b4240fe2bfaa21de8a554bc93c0b5be11ab30
SHA256

3c4da1db936b6a740a0701f364ccd3a5d2bcc5f3a8a934a10e68f13e829476ec
SHA512

3b7be983404b18912ed844a8aac097d6156c9f957c32874e525efd17a8a0b990bbb69f33f7056d9f71c53000f46f45b5cc1506f8b76b03f6bfca8b67f4d634d1
SSDEEP

393216:Pw//lRv1JAhFnEjxpXaBkdoNGhEsnYxqZVmchA:o3lyhMpXaids8RnaR

Score

9^/10

evasion execution persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Loader.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\winhb.sys	Loader.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Loader.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Loader.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2899}	Loader.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2444}	Loader.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2879}	Loader.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2859}	Loader.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2869}	Loader.exe
File opened for modification	C:\Windows\System32\IME\IMETC\{69CD1F2D-DF68-4E23-9108-1B70783F2879}	Loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1992	Loader.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-UPDATE}	Loader.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2893}	Loader.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2892}	Loader.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2859}	Loader.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
712	sc.exe
3396	sc.exe
2988	sc.exe
1400	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
632	Process not Found
632	Process not Found

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 4736	1992	Loader.exe	73
PID 1992 wrote to memory of 4736	1992	Loader.exe	73
PID 4736 wrote to memory of 2988	4736	cmd.exe	75
PID 4736 wrote to memory of 2988	4736	cmd.exe	75
PID 1992 wrote to memory of 960	1992	Loader.exe	76
PID 1992 wrote to memory of 960	1992	Loader.exe	76
PID 960 wrote to memory of 1400	960	cmd.exe	78
PID 960 wrote to memory of 1400	960	cmd.exe	78
PID 1992 wrote to memory of 2024	1992	Loader.exe	79
PID 1992 wrote to memory of 2024	1992	Loader.exe	79
PID 1992 wrote to memory of 5040	1992	Loader.exe	80
PID 1992 wrote to memory of 5040	1992	Loader.exe	80
PID 1992 wrote to memory of 2372	1992	Loader.exe	83
PID 1992 wrote to memory of 2372	1992	Loader.exe	83
PID 2372 wrote to memory of 4492	2372	cmd.exe	84
PID 2372 wrote to memory of 4492	2372	cmd.exe	84
PID 2372 wrote to memory of 3376	2372	cmd.exe	85
PID 2372 wrote to memory of 3376	2372	cmd.exe	85
PID 2372 wrote to memory of 4856	2372	cmd.exe	86
PID 2372 wrote to memory of 4856	2372	cmd.exe	86
PID 1992 wrote to memory of 1364	1992	Loader.exe	87
PID 1992 wrote to memory of 1364	1992	Loader.exe	87
PID 5040 wrote to memory of 3396	5040	cmd.exe	88
PID 5040 wrote to memory of 3396	5040	cmd.exe	88
PID 2024 wrote to memory of 712	2024	cmd.exe	89
PID 2024 wrote to memory of 712	2024	cmd.exe	89
PID 1992 wrote to memory of 2020	1992	Loader.exe	90
PID 1992 wrote to memory of 2020	1992	Loader.exe	90

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\system32\sc.exe
    sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
    3⤵
    - Launches sc.exe
    PID:2988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc start windowsproc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\system32\sc.exe
    sc start windowsproc
    3⤵
    - Launches sc.exe
    PID:1400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\system32\sc.exe
    sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
    3⤵
    - Launches sc.exe
    PID:712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc start windowsproc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\system32\sc.exe
    sc start windowsproc
    3⤵
    - Launches sc.exe
    PID:3396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader.exe" MD5
    3⤵
    PID:4492
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3376
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-0-0x0000000140000000-0x0000000141C8C000-memory.dmp

Filesize
28.5MB

Download
memory/1992-1-0x00007FFBEEA98000-0x00007FFBEEA9A000-memory.dmp

Filesize
8KB

Download
memory/1992-2-0x0000000140000000-0x0000000141C8C000-memory.dmp

Filesize
28.5MB

Download
memory/1992-4-0x0000000140000000-0x0000000141C8C000-memory.dmp

Filesize
28.5MB

Download
memory/1992-3-0x0000000140000000-0x0000000141C8C000-memory.dmp

Filesize
28.5MB

Download
memory/1992-9-0x0000000140000000-0x0000000141C8C000-memory.dmp

Filesize
28.5MB

Download
memory/1992-18-0x0000000140000000-0x0000000141C8C000-memory.dmp

Filesize
28.5MB

Download