0cd8a40ff7ceef9c1368446d6ead91549681e88fdfa0f9f5a63c03fe38420baf

General

Target
al-khaser_x64.exe
Size 274KB
Sample261030-rkscaacy2w
SHA256 0cd8a40ff7ceef9c1368446d6ead91549681e88fdfa0f9f5a63c03fe38420baf
MD5 d5a6753ff6151e72690f615fbfc1844e
SHA1 d6820a5803d94897888f994cd8d90f607874ac42
SHA512 04c5c54c0c53d7dc23caddc44217a917f2fb065d4c6cd349edc02a725ef893c975704ca87db388ed023cfdb97c3b57e3b706f7c2309e53e4c2241bea81b41401
SSDEEP 6144:fj2h45zOFBXMIMd9y5bwm7UZNX2NNNylIC7:f+4VeXM/fy3omNW
TLSH
T131545B12F7E84055F6E796B8DEB24001DE72B8450B31D16F1748C9B90F7AA84FB7AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	al-khaser_x64.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	al-khaser_x64.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	al-khaser_x64.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	al-khaser_x64.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	al-khaser_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	al-khaser_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	al-khaser_x64.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\SOFTWARE\Wine	al-khaser_x64.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	al-khaser_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	al-khaser_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	al-khaser_x64.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	al-khaser_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	al-khaser_x64.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 3 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	al-khaser_x64.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	al-khaser_x64.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	al-khaser_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	al-khaser_x64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	al-khaser_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	al-khaser_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	al-khaser_x64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	al-khaser_x64.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe
1252	al-khaser_x64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1252	al-khaser_x64.exe
Token: SeCreatePagefilePrivilege	1252	al-khaser_x64.exe

C:\Users\Admin\AppData\Local\Temp\al-khaser_x64.exe
"C:\Users\Admin\AppData\Local\Temp\al-khaser_x64.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Maps connected drives based on registry
- Checks system information in the registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

Direct Volume Access

Virtualization/Sandbox Evasion

5

T1497

Credential Access

Discovery

Debugger Evasion

1

T1622

Peripheral Device Discovery

Query Registry

System Information Discovery

5

T1082

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

1

T1016.001

Virtualization/Sandbox Evasion

5

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

log.txt

Path C:\Users\Admin\AppData\Local\Temp\log.txt
Size 4KB
SHA256 0312bd73b273aa1d3df41282020282073c989ef43f515fc08ca2ee578c58cd2e
MD5 e4ce0a6986cca4c3e37ca8a7abfcb7eb
SHA1 acc8ce3212dce518fdba2565bf1dbf555071d4b1
SHA512 e188767472f5634a6a56806a5c5f903a4043d1f32a6e4a311072d145d0aeb5a97aef02e7d8a763265dd610c399cd1a34624502c7ea0f695eb284625197ec7bad
SSDEEP 96:l367T7W7n777j7p7f7U7c7w7U8U7h7/7Zx7T7z7rc7f7M7l737e7WC7B7r7W7oVJ:u/I73v1DG+6s9jZt/fr+DOprAtdHIo51
TLSH
T1EF91640E40E63530AABD52D354D48DD91FECD8C6EF51D7BE39988EEC12036E2ABB1841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-47-0x0000015EE3350000-0x0000015EE4350000-memory.dmp

Download

memory/1252-112-0x0000015EE3350000-0x0000015EE4350000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads