Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 02:53
General
- Target Shabi.exe
- Size 21.0MB
- Sample260723-ddal1aff26
- SHA256 24d1fb44d9aa99cc650ce1ab279d9bd2914b11c706449807fe74e5ee0670a905
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 4 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- Loads dropped DLL 36 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shabi.exe"C:\Users\Admin\AppData\Local\Temp\Shabi.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shabi.exe"C:\Users\Admin\AppData\Local\Temp\Shabi.exe"2⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "$cs=Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue; $bios=Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue; $txt=@($cs.Manufacturer,$cs.Model,$bios.SerialNumber,$bios.Version) -join '|'; if ($txt -match 'vmware|virtualbox|vbox|qemu|kvm|xen|parallels|bochs|innotek') { exit 0 } else { exit 1 }"3⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_chacha20.pyd
_raw_aes.pyd
_raw_aesni.pyd
_BLAKE2s.pyd
_poly1305.pyd
_cpuid_c.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
INSTALLER
pyexpat.pyd
python315.dll
pythoncom315.dll
pywintypes315.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
win32api.pyd
win32crypt.pyd
win32event.pyd
memory/2156-773-0x00007FF804BE0000-0x00007FF805584000-memory.dmp
memory/2156-783-0x00007FF804BE0000-0x00007FF805584000-memory.dmp
memory/2156-774-0x00007FF804BE0000-0x00007FF805584000-memory.dmp
memory/2156-778-0x00007FF804BE0000-0x00007FF805584000-memory.dmp
memory/2156-779-0x00007FF804BE0000-0x00007FF805584000-memory.dmp
memory/2156-777-0x000001B5BBE60000-0x000001B5BBE82000-memory.dmp
memory/2156-780-0x00007FF804BE0000-0x00007FF805584000-memory.dmp
memory/2156-781-0x00007FF804BE0000-0x00007FF805584000-memory.dmp
memory/2156-782-0x00007FF804BE0000-0x00007FF805584000-memory.dmp
memory/2156-772-0x00007FF804D6F000-0x00007FF804D70000-memory.dmp
memory/2156-787-0x000001B5BC130000-0x000001B5BC1E2000-memory.dmp
memory/2156-786-0x000001B5BBF00000-0x000001B5BBF1E000-memory.dmp
memory/2156-788-0x000001B5BBF20000-0x000001B5BBF2A000-memory.dmp
memory/2156-790-0x000001B5BC470000-0x000001B5BC494000-memory.dmp
memory/2156-789-0x000001B5BC470000-0x000001B5BC49A000-memory.dmp
memory/2156-792-0x00007FF804BE0000-0x00007FF805584000-memory.dmp
memory/2156-793-0x00007FF804BE0000-0x00007FF805584000-memory.dmp