Analysis
-
max time kernel
73s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04-11-2024 02:20
Behavioral task
behavioral1
Sample
4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe
Resource
win7-20241010-en
General
-
Target
4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe
-
Size
3.4MB
-
MD5
b45668e08c03024f2432ff332c319131
-
SHA1
4bef9109eaeace4107c47858eef2d9d3487e45f0
-
SHA256
4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe
-
SHA512
538c8471fc0313e68885d4d09140ec3e3374af3464af626195b6387a67b9bae9c3c9fd369d9dc7965decc182d13e8bbf95b4cf96b5ffc78af5d7904d59325bbc
-
SSDEEP
98304:MHKnK7qkC+8TMGHgWnvLBQ0YXpS3KZFc6LUARABDgAj:MqKYx9zu0YpSaZFcJA6BDga
Malware Config
Signatures
-
Detects ZharkBot payload 4 IoCs
ZharkBot is a botnet written C++.
resource yara_rule behavioral1/memory/1804-47-0x0000000000400000-0x0000000000455000-memory.dmp zharkcore behavioral1/memory/1804-43-0x0000000000400000-0x0000000000455000-memory.dmp zharkcore behavioral1/memory/1804-45-0x0000000000400000-0x0000000000455000-memory.dmp zharkcore behavioral1/memory/1804-42-0x0000000000400000-0x0000000000455000-memory.dmp zharkcore -
Zharkbot family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ucloud.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ucloud.exe Powershell.exe -
resource yara_rule behavioral1/memory/1740-24-0x0000000000A60000-0x00000000012DE000-memory.dmp themida behavioral1/memory/1740-56-0x0000000000A60000-0x00000000012DE000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1740 set thread context of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 -
Program crash 1 IoCs
pid pid_target Process procid_target 2248 1804 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 3056 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe Token: SeDebugPrivilege 3056 Powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2972 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 30 PID 1740 wrote to memory of 2972 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 30 PID 1740 wrote to memory of 2972 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 30 PID 1740 wrote to memory of 2972 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 30 PID 1740 wrote to memory of 2972 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 30 PID 1740 wrote to memory of 2972 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 30 PID 1740 wrote to memory of 2972 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 30 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1740 wrote to memory of 1804 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 31 PID 1804 wrote to memory of 2248 1804 RegAsm.exe 32 PID 1804 wrote to memory of 2248 1804 RegAsm.exe 32 PID 1804 wrote to memory of 2248 1804 RegAsm.exe 32 PID 1804 wrote to memory of 2248 1804 RegAsm.exe 32 PID 1740 wrote to memory of 3056 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 33 PID 1740 wrote to memory of 3056 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 33 PID 1740 wrote to memory of 3056 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 33 PID 1740 wrote to memory of 3056 1740 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe"C:\Users\Admin\AppData\Local\Temp\4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2972
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 2883⤵
- Program crash
PID:2248
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ucloud.exe'2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056
-