Analysis

  • max time kernel
    87s
  • max time network
    91s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241023-en
  • resource tags

    arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/01/2025, 20:50

General

  • Target

    utility-1.0.6.3.exe

  • Size

    83.1MB

  • MD5

    f1b839e3e730d65be42c55ae50fc9108

  • SHA1

    5abd2f6f1a8e194021c8f9032753eeafb0af54e7

  • SHA256

    1b57734ff8cb74b218aa7c0920933e21142006a868f16e1ff51fab4f1d93d965

  • SHA512

    c52bd2db3e6bf255f6719552a4575928b4b0a69b15300ee48d46418f6de10d4e1871b575a58454c877e6a3b5beb75597110d4aef137725966105bc9344742a95

  • SSDEEP

    1572864:XH5NKTg39geYPkantXvZx9IuBoFQWeLlL+G3ELmKWu5IK4lsOHJ10TER94Jc:nKc39bYPk6BvxBoFVeLFLEyNu5j2HJO2

Malware Config

Signatures

  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Themida packer 9 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\utility-1.0.6.3.exe
    "C:\Users\Admin\AppData\Local\Temp\utility-1.0.6.3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\utility.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\utility.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4860

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Runtime64.dll

          Filesize

          9.4MB

          MD5

          1536bbb84ce32cfcaf72dbcfd5949401

          SHA1

          1c6742ed78c708672e06f2c8a4c989bc5e5a838d

          SHA256

          e3bcb8faecc22a443d41312b80e798a6358749d8b266a1bfc66ede45009e7b92

          SHA512

          387dda2304d0da1ed732c3d4a8f49987e5998251634cd8b449dd4821a0f7834830d7caaea5a0616ed5810ac4595d8355645266856cc8ba1e4bfed50c874c755e

        • memory/4860-34-0x0000019C307A0000-0x0000019C30B76000-memory.dmp

          Filesize

          3.8MB

        • memory/4860-36-0x0000019C30C10000-0x0000019C30DFA000-memory.dmp

          Filesize

          1.9MB

        • memory/4860-17-0x0000019C10C10000-0x0000019C1512C000-memory.dmp

          Filesize

          69.1MB

        • memory/4860-21-0x00007FFA0CAD0000-0x00007FFA0D592000-memory.dmp

          Filesize

          10.8MB

        • memory/4860-22-0x0000000180000000-0x0000000181261000-memory.dmp

          Filesize

          18.4MB

        • memory/4860-23-0x00007FF47A870000-0x00007FF47AA78000-memory.dmp

          Filesize

          2.0MB

        • memory/4860-24-0x00007FFA0CAD0000-0x00007FFA0D592000-memory.dmp

          Filesize

          10.8MB

        • memory/4860-27-0x0000000180000000-0x0000000181261000-memory.dmp

          Filesize

          18.4MB

        • memory/4860-26-0x0000000180000000-0x0000000181261000-memory.dmp

          Filesize

          18.4MB

        • memory/4860-25-0x0000000180000000-0x0000000181261000-memory.dmp

          Filesize

          18.4MB

        • memory/4860-37-0x0000019C30E00000-0x0000019C30E96000-memory.dmp

          Filesize

          600KB

        • memory/4860-28-0x0000000180000000-0x0000000181261000-memory.dmp

          Filesize

          18.4MB

        • memory/4860-30-0x0000019C2F550000-0x0000019C2F622000-memory.dmp

          Filesize

          840KB

        • memory/4860-33-0x0000019C2F550000-0x0000019C2F622000-memory.dmp

          Filesize

          840KB

        • memory/4860-31-0x0000019C2F550000-0x0000019C2F622000-memory.dmp

          Filesize

          840KB

        • memory/4860-16-0x00007FFA0CAD3000-0x00007FFA0CAD5000-memory.dmp

          Filesize

          8KB

        • memory/4860-18-0x0000019C2F550000-0x0000019C2F628000-memory.dmp

          Filesize

          864KB

        • memory/4860-35-0x0000019C30B80000-0x0000019C30C18000-memory.dmp

          Filesize

          608KB

        • memory/4860-29-0x00007FFA0B380000-0x00007FFA0B4CF000-memory.dmp

          Filesize

          1.3MB

        • memory/4860-38-0x0000019C30EA0000-0x0000019C30F34000-memory.dmp

          Filesize

          592KB

        • memory/4860-39-0x00007FFA0CAD3000-0x00007FFA0CAD5000-memory.dmp

          Filesize

          8KB

        • memory/4860-40-0x0000000180000000-0x0000000181261000-memory.dmp

          Filesize

          18.4MB

        • memory/4860-41-0x00007FFA0CAD0000-0x00007FFA0D592000-memory.dmp

          Filesize

          10.8MB

        • memory/4860-42-0x0000000180000000-0x0000000181261000-memory.dmp

          Filesize

          18.4MB

        • memory/4860-43-0x00007FFA0CAD0000-0x00007FFA0D592000-memory.dmp

          Filesize

          10.8MB

        • memory/4860-44-0x0000019C39630000-0x0000019C3D54C000-memory.dmp

          Filesize

          63.1MB

        • memory/4860-45-0x00007FFA0CAD0000-0x00007FFA0D592000-memory.dmp

          Filesize

          10.8MB

        • memory/4860-46-0x00007FFA0CAD0000-0x00007FFA0D592000-memory.dmp

          Filesize

          10.8MB

        • memory/4860-47-0x0000019C2F1B0000-0x0000019C2F1B1000-memory.dmp

          Filesize

          4KB

        • memory/4860-48-0x0000019C2F680000-0x0000019C2F692000-memory.dmp

          Filesize

          72KB

        • memory/4860-49-0x0000019C2F9E0000-0x0000019C2FA1C000-memory.dmp

          Filesize

          240KB

        • memory/4860-50-0x0000000180000000-0x0000000181261000-memory.dmp

          Filesize

          18.4MB

        • memory/4860-51-0x00007FFA0CAD0000-0x00007FFA0D592000-memory.dmp

          Filesize

          10.8MB

        • memory/4860-53-0x00007FFA0CAD0000-0x00007FFA0D592000-memory.dmp

          Filesize

          10.8MB