Analysis
- user interaction
yes - max time kernel
14s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
17/05/2026, 22:32
Errors
General
- Target Virus.exe
- Size 921KB
- Sample260517-2f6zzsdv4x
- SHA256 2cac45c4e575e1beb4e02a697e871414bdb34c04fea12e661df4f58551857d0d
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Virus.exe"C:\Users\Admin\AppData\Local\Temp\Virus.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 13804⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2884 -ip 28841⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Virus REvi DRX1.exe.log
sByte.dll
Virus REvi DRX1.exe
memory/2372-22-0x0000000000F20000-0x0000000000FC2000-memory.dmp
memory/2372-23-0x0000000005A30000-0x0000000005A40000-memory.dmp
memory/2564-2-0x0000000001510000-0x000000000151C000-memory.dmp
memory/2564-0-0x0000000000B20000-0x0000000000C0C000-memory.dmp
memory/2564-6-0x000000001B810000-0x000000001B8B2000-memory.dmp
memory/2564-1-0x000000001B9F0000-0x000000001BA00000-memory.dmp
memory/2884-28-0x0000000000340000-0x0000000000370000-memory.dmp
memory/2884-29-0x0000000004FE0000-0x0000000005586000-memory.dmp
memory/2884-30-0x0000000004B10000-0x0000000004BA2000-memory.dmp
memory/2884-31-0x0000000004BF0000-0x0000000004BFA000-memory.dmp