Analysis
-
max time kernel
140s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
-
submitted
13/04/2025, 02:32
General
-
Target
DowloadX.exe
-
Size
2.1MB
-
MD5
e6964640c38b37d47d1af6f62d84293d
-
SHA1
5fb66c1612d6931f5b9411ac697225812783b18b
-
SHA256
ae93c138b8c1e7b3af5853244f1bd81d723b4bdd487caf00fb47e308d324798e
-
SHA512
8178e081f63d403702c117b8b6bbf46f437e11d553e7ac0fa4a65e7bbd73a8d3a4026799283edfaf4c7b78d0ffbbd30f69ede60af8306238643d65fd86d89e99
-
SSDEEP
49152:hNGj8GrEoUj035sC1b70Z84xBUMDn6MOSKxYhMTJA3xanaVY3x/nWf/0:PWEoUjfC17341vBiJ2anfhnWH0
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DowloadX.exe"C:\Users\Admin\AppData\Local\Temp\DowloadX.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD550821ebf182fa181c4b10518f65a52f1
SHA144f19079d6a9b80a131e02fb0ba9978ca5a60751
SHA25646cb8940f7144e99d0ebe79d27b3194fc357fd5b5b2d83bfccd3e4cbbfdce4eb
SHA5124f93d1f4aeec6d47ab388f36c9aee961bca6a7297bb672d0da3dab47f7f449969b62de28763d90fabc4a6d5d5a7bd04fd98875a37d03129db9ee32ec163767b8
-
Filesize
15KB
MD5b703df2603ff79f25545727352d60db0
SHA161602da53ac444d76ec9061086dd651f439f27a7
SHA2569b6dcef4ca677a8fc78247b409987756e79588e847592ed5c56717e8b0bf4561
SHA512c04fdde05ab5288b28573a04d559bea4a81398cd3891d2d5cccadb276a5b22e84426a39c57ff65bd9ab6d761aa42a84cbf1940ed80c258fb9c9def42bd770ac8
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
368KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
5.2MB
-
Filesize
5.2MB