a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5

General

Target
15d0b0f44a40bd7fa1b7118ad81d094d.exe
Size 302KB
Sample261113-pcrdxabt5k
SHA256 a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5
MD5 15d0b0f44a40bd7fa1b7118ad81d094d
SHA1 cd87da979087f12606a1ab99b37f1ab9af0d49fa
SHA512 719b4b32635aa3b25e580c1e3b8fc46efbc0c508dd35e952d3379b2f161f1f7e35e14dfa831645261219a2d9e54c379d61f4841f1db37e427614b369a8515b39
SSDEEP 6144:IWGD1VFXWo+A+9bjGDkt4w7CGV/tEpdgkqai/6o/yHbsABG0s+NBUpE:a1VFmHAQu+4wB4pdgUiSo3ABJr
TLSH
T10C6423A72BA29F6ACF6EEAF4C1F57470B9920F5FC2BB0114A7DC0DDA183D4244865907
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery upx

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	15d0b0f44a40bd7fa1b7118ad81d094d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	15d0b0f44a40bd7fa1b7118ad81d094d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	15d0b0f44a40bd7fa1b7118ad81d094d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	15d0b0f44a40bd7fa1b7118ad81d094d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	15d0b0f44a40bd7fa1b7118ad81d094d.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	15d0b0f44a40bd7fa1b7118ad81d094d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	15d0b0f44a40bd7fa1b7118ad81d094d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	15d0b0f44a40bd7fa1b7118ad81d094d.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	15d0b0f44a40bd7fa1b7118ad81d094d.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	15d0b0f44a40bd7fa1b7118ad81d094d.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	15d0b0f44a40bd7fa1b7118ad81d094d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	15d0b0f44a40bd7fa1b7118ad81d094d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	15d0b0f44a40bd7fa1b7118ad81d094d.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	15d0b0f44a40bd7fa1b7118ad81d094d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	15d0b0f44a40bd7fa1b7118ad81d094d.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4600-0-0x00007FF725610000-0x00007FF7256EE000-memory.dmp	upx
behavioral2/memory/4600-1-0x00007FF725610000-0x00007FF7256EE000-memory.dmp	upx

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	15d0b0f44a40bd7fa1b7118ad81d094d.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	15d0b0f44a40bd7fa1b7118ad81d094d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	15d0b0f44a40bd7fa1b7118ad81d094d.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	15d0b0f44a40bd7fa1b7118ad81d094d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	15d0b0f44a40bd7fa1b7118ad81d094d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	15d0b0f44a40bd7fa1b7118ad81d094d.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4600	15d0b0f44a40bd7fa1b7118ad81d094d.exe
4600	15d0b0f44a40bd7fa1b7118ad81d094d.exe
4600	15d0b0f44a40bd7fa1b7118ad81d094d.exe
4600	15d0b0f44a40bd7fa1b7118ad81d094d.exe
4600	15d0b0f44a40bd7fa1b7118ad81d094d.exe
4600	15d0b0f44a40bd7fa1b7118ad81d094d.exe
4600	15d0b0f44a40bd7fa1b7118ad81d094d.exe
4600	15d0b0f44a40bd7fa1b7118ad81d094d.exe
4600	15d0b0f44a40bd7fa1b7118ad81d094d.exe
4600	15d0b0f44a40bd7fa1b7118ad81d094d.exe

C:\Users\Admin\AppData\Local\Temp\15d0b0f44a40bd7fa1b7118ad81d094d.exe
"C:\Users\Admin\AppData\Local\Temp\15d0b0f44a40bd7fa1b7118ad81d094d.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks system information in the registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4600