Analysis
-
max time kernel
141s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
-
submitted
13/04/2025, 02:36
General
-
Target
DowloadX.exe
-
Size
2.1MB
-
MD5
e6964640c38b37d47d1af6f62d84293d
-
SHA1
5fb66c1612d6931f5b9411ac697225812783b18b
-
SHA256
ae93c138b8c1e7b3af5853244f1bd81d723b4bdd487caf00fb47e308d324798e
-
SHA512
8178e081f63d403702c117b8b6bbf46f437e11d553e7ac0fa4a65e7bbd73a8d3a4026799283edfaf4c7b78d0ffbbd30f69ede60af8306238643d65fd86d89e99
-
SSDEEP
49152:hNGj8GrEoUj035sC1b70Z84xBUMDn6MOSKxYhMTJA3xanaVY3x/nWf/0:PWEoUjfC17341vBiJ2anfhnWH0
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DowloadX.exe"C:\Users\Admin\AppData\Local\Temp\DowloadX.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5ca566c1d412cdc9fde51d2379c52b7a2
SHA11bf17d3cf5180e9fd857bd6ff44881381c730503
SHA25634c63c1b14a0526b6f3f7c33a37235f94b06ce4ea0b01d8e0b08956c5c9e1102
SHA5129b5d062bda9e24154f744e52e2707c3ac572a9ed50a5474f367afcc3d37e4390ebc2a8c7e75017557090aee21275936a15265e0d4bce8dda7f7eb23819dd8704
-
Filesize
15KB
MD583017784e311874a3958af6a28eaf111
SHA18953bb21cd0d5c51f0e8a843e7b7e338b3d5fd09
SHA256407f20da034d699a4cd247d67f285694d193cf763b549e4e0c560ccafe57bbaf
SHA5123cc09fa2f164951212274a4ec30c87a17a84be162fa60a48a5896db01aef435bc49950c7b025df875a022e271b11e7e0e147e29d2145cc752c9c50ba53a7d905
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
368KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB