General

  • Target

    sample

  • Size

    16KB

  • Sample

    241110-wkf2gascmb

  • MD5

    daa1775c5d069eaa1cff967dbc615ee7

  • SHA1

    90f94df7a39c969cd3b456ac5f96ae275a5be912

  • SHA256

    1b364d5cbcc925ba55e6e2dc6a836468786732a0a3a8d35072d2b70e9064363e

  • SHA512

    c58fc487e1ead2c8966156c63946363411ce20df068919bec35d785661f01a20b5593f8568d4e56b8c2337065133ee9aa75062312d0e6b762f625496753dac92

  • SSDEEP

    384:12bE/91KFpEOFYDuveu4TG2/r/ljV/4ErRAfZwXilVXs1t2D2ZdQw1Hjn2:59il8uveZLzdaErREvM24HT2

Malware Config

Targets

    • Target

      sample

    • Size

      16KB

    • MD5

      daa1775c5d069eaa1cff967dbc615ee7

    • SHA1

      90f94df7a39c969cd3b456ac5f96ae275a5be912

    • SHA256

      1b364d5cbcc925ba55e6e2dc6a836468786732a0a3a8d35072d2b70e9064363e

    • SHA512

      c58fc487e1ead2c8966156c63946363411ce20df068919bec35d785661f01a20b5593f8568d4e56b8c2337065133ee9aa75062312d0e6b762f625496753dac92

    • SSDEEP

      384:12bE/91KFpEOFYDuveu4TG2/r/ljV/4ErRAfZwXilVXs1t2D2ZdQw1Hjn2:59il8uveZLzdaErREvM24HT2

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

    • A potential corporate email address has been identified in the URL: [email protected]

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks