Overview

overview

10

Static

static

10

Malware-1-...30.exe

windows7-x64

10

Malware-1-...30.exe

windows10-2004-x64

10

Malware-1-...40.exe

windows7-x64

10

Malware-1-...40.exe

windows10-2004-x64

10

Malware-1-...32.exe

windows7-x64

10

Malware-1-...32.exe

windows10-2004-x64

10

Malware-1-.../5.exe

windows7-x64

10

Malware-1-.../5.exe

windows10-2004-x64

10

Malware-1-...91.exe

windows7-x64

10

Malware-1-...91.exe

windows10-2004-x64

10

Malware-1-...ey.exe

windows7-x64

7

Malware-1-...ey.exe

windows10-2004-x64

7

Malware-1-...ad.exe

windows7-x64

3

Malware-1-...ad.exe

windows10-2004-x64

3

Malware-1-...ve.bat

windows7-x64

7

Malware-1-...ve.bat

windows10-2004-x64

7

Malware-1-...ve.exe

windows7-x64

6

Malware-1-...ve.exe

windows10-2004-x64

7

Malware-1-...ya.exe

windows7-x64

6

Malware-1-...ya.exe

windows10-2004-x64

Malware-1-...re.exe

windows7-x64

10

Malware-1-...re.exe

windows10-2004-x64

10

Malware-1-...ry.exe

windows7-x64

10

Malware-1-...ry.exe

windows10-2004-x64

10

Malware-1-...ue.exe

windows7-x64

3

Malware-1-...ue.exe

windows10-2004-x64

1

Malware-1-...kt.bat

windows7-x64

7

Malware-1-...kt.bat

windows10-2004-x64

Malware-1-...o3.exe

windows7-x64

Malware-1-...o3.exe

windows10-2004-x64

10

Malware-1-...ey.exe

windows7-x64

10

Malware-1-...ey.exe

windows10-2004-x64

10

Resubmissions

13/02/2025, 01:26 UTC

250213-btppra1pcz 10

17/01/2025, 20:14 UTC

250117-yz7h3s1qfw 10

17/01/2025, 20:12 UTC

250117-yy9l2sslcr 10

17/01/2025, 17:25 UTC

250117-vy9p9sxpez 10

17/01/2025, 17:21 UTC

250117-vw8eesyjfp 10

17/01/2025, 14:16 UTC

250117-rk9ass1rhk 10

17/01/2025, 14:12 UTC

250117-rhv1ds1lds 10

16/01/2025, 12:52 UTC

250116-p4et7a1mez 10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/01/2025, 14:16 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Malware-1-master/iimo3.exe

  • Size

    1.7MB

  • MD5

    4f8767983d865a5e706ae3c6aa5ab6c5

  • SHA1

    535bc0a1cf7140176fd6e6a205f3394d146c2ba3

  • SHA256

    5ac017285572c24fc8b77324a52ca484e83c3622c61bea80a74a6850f0a16061

  • SHA512

    a88e5fd993d2fdde869ef32a5271d5bbd222f2174217bf4e2c4cea6fad624d237b3528478b70ab1ec5011bd031fc93319865f5877e06fb3efcc53cc5c7e786a3

  • SSDEEP

    49152:ZgTJ84RvagaNgNu5W05jvIAo69PnaLgnMu4x:ZgmmygtNfCvjf58

Score
10/10
discoveryevasiontrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Malware-1-master\iimo3.exe
    "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\iimo3.exe"
    1⤵
    • UAC bypass
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • System policy modification
    PID:2004

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    72.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    252.103.5.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    252.103.5.23.in-addr.arpa
    IN PTR
    Response
    252.103.5.23.in-addr.arpa
    IN PTR
    a23-5-103-252deploystaticakamaitechnologiescom
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.137.101.95.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.137.101.95.in-addr.arpa
    IN PTR
    Response
    83.137.101.95.in-addr.arpa
    IN PTR
    a95-101-137-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    31.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    31.243.111.52.in-addr.arpa
    IN PTR
    Response
  • 210.134.66.83:55555
    iimo3.exe
    260 B
     5
  • 210.134.66.83:55555
    iimo3.exe
    260 B
     5
  • 210.134.66.83:55555
    iimo3.exe
    260 B
     5
  • 210.134.66.83:55555
    iimo3.exe
    260 B
     5
  • 210.134.66.83:55555
    iimo3.exe
    260 B
     5
  • 210.134.66.83:55555
    iimo3.exe
    260 B
     5
  • 210.134.66.83:55555
    iimo3.exe
    260 B
     5
  • 210.134.66.83:55555
    iimo3.exe
    104 B
     2
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    72.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    72.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    252.103.5.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    252.103.5.23.in-addr.arpa

  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    83.137.101.95.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    83.137.101.95.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    31.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    31.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Malware-1-master\Config.ini
    Filesize

    1KB

    MD5

    2db7a58f4892054c7077dab88fd68b86

    SHA1

    acf198a9160a872bc8633fc9185ad317e69bf2a4

    SHA256

    01701b302ab45f11729fac64ba33cd7b53abbc94963578d9813a1f5848e75618

    SHA512

    01926e211445f72f6637f7be04af33339f4acd78b3d2e8f4b6b4e0c28ea6c2662ea0aec976cc8a4f875ab1d12ca20eec7ebf59fe3704f76dc4adac3a0766511c

    Download Submit

  • memory/2004-27-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-29-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-13-0x0000000000411000-0x000000000042C000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2004-5-0x0000000004A70000-0x0000000004A72000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2004-12-0x0000000004B10000-0x0000000004B11000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-11-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-10-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-9-0x0000000004A80000-0x0000000004A81000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-8-0x0000000004B20000-0x0000000004B21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-7-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-6-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-4-0x0000000004B40000-0x0000000004B41000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-3-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-17-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-1-0x00000000777E4000-0x00000000777E6000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2004-0-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-2-0x0000000004A60000-0x0000000004A61000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-30-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-28-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-31-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-32-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-33-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-34-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-35-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-36-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-37-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-38-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-39-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-40-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-41-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-42-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-43-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

  • memory/2004-44-0x0000000000410000-0x000000000089A000-memory.dmp

    Filesize

    4.5MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.