General
- Target RealSetup_f24c1326bdfa675095bde9b7b3d4bd2a6d098c9f8a5fd3bfda0e62ca52edbcc4.exe
- Size 16.3MB
- Sample260719-dm2f3sav3r
- SHA256 8f1c661b542a5c7c1b69fe2900a97e0d82bb2ef75322c2470e21986e6a438d17
Score
9/10
Malware Config
Targets
-
- Target RealSetup_f24c1326bdfa675095bde9b7b3d4bd2a6d098c9f8a5fd3bfda0e62ca52edbcc4.exe
- Size 16.3MB
- SHA256 8f1c661b542a5c7c1b69fe2900a97e0d82bb2ef75322c2470e21986e6a438d17
Score9/10Identifies VirtualBox via ACPI registry values (likely anti-VM)
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
A potential corporate email address has been identified in the URL: [email protected]
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Network Share Discovery
Attempt to gather information on host network.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1Scheduled Task
1