Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 03:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Imian ARK INI.exe
Resource
win7-20241010-en
5 signatures
150 seconds
General
-
Target
Imian ARK INI.exe
-
Size
4.1MB
-
MD5
f0f155f68a253e2da54d56cf8b3440a6
-
SHA1
3d1e334ba82a073a95ad0d1d9e939b441f2c839c
-
SHA256
bcf68a26d93f182b81cb9f211b7f4fafc8dd283e68f2957bb19185817753c605
-
SHA512
673809a88494c2428938a669c8b50ce7fcba384d0fae8f62a4fdb1dcbd3546280c67857cf38fbd4cef0031e88203ae92010e4583caf185de4ea1e996ac28e207
-
SSDEEP
98304:gNUvbIDn+S3UWNRl9jKxSIj9gEtVeq7pX56zbWSi/ivkgzXPK:gNYuH3U4Rl9juFPjcbW5/it+
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Imian ARK INI.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Imian ARK INI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Imian ARK INI.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Imian ARK INI.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3040 Imian ARK INI.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3040 Imian ARK INI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Imian ARK INI.exe"C:\Users\Admin\AppData\Local\Temp\Imian ARK INI.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3040