General
- Target RealSetup_9a47ef8cb6f5bffc355da9bf077a1dd52ab20ec8f1123ff67759a60624e7adac.exe
- Size 16.3MB
- Sample260720-c3jqjafv2s
- SHA256 8f1c661b542a5c7c1b69fe2900a97e0d82bb2ef75322c2470e21986e6a438d17
Malware Config
Targets
-
- Target RealSetup_9a47ef8cb6f5bffc355da9bf077a1dd52ab20ec8f1123ff67759a60624e7adac.exe
- Size 16.3MB
- SHA256 8f1c661b542a5c7c1b69fe2900a97e0d82bb2ef75322c2470e21986e6a438d17
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Network Share Discovery
Attempt to gather information on host network.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Query Registry
8Remote System Discovery
1System Information Discovery
7System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
1