f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0

General

Target

f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe
Size

3.8MB
MD5

79a7de437dad73c33490fc8dd3f9d6c5
SHA1

3ebd89f9bf858ae9f6d460fde0875ef2061c8535
SHA256

f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0
SHA512

152990cbc3ccf22d08326a2e5f58cb0f8c96f7d5e20a82a90b894061df85cef800b6e26ee325ced9cea468e7f83fee3f6a6277efdb7d95db81f6517e824e0f73

Score

9^/10

evasion trojan

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ESETNOD.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ESETNOD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ESETNOD.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Loads dropped DLL 6 IoCs

Processes:

f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exestart.exe

pid	process
1500	f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe
1500	f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe
1500	f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe
1500	f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe
1020	start.exe
1020	start.exe

Executes dropped EXE 2 IoCs

Processes:

start.exeESETNOD.exe

pid process

1020 start.exe
1084 ESETNOD.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

ESETNOD.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ESETNOD.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

ESETNOD.exe

pid process

1084 ESETNOD.exe

pid	process
1020	start.exe
1084	ESETNOD.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ESETNOD.exe

pid	process
1084	ESETNOD.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exestart.exe

description	pid	process	target process
PID 1500 wrote to memory of 1616	1500	f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe	NOTEPAD.EXE
PID 1500 wrote to memory of 1616	1500	f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe	NOTEPAD.EXE
PID 1500 wrote to memory of 1616	1500	f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe	NOTEPAD.EXE
PID 1500 wrote to memory of 1616	1500	f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe	NOTEPAD.EXE
PID 1500 wrote to memory of 1020	1500	f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe	start.exe
PID 1500 wrote to memory of 1020	1500	f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe	start.exe
PID 1500 wrote to memory of 1020	1500	f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe	start.exe
PID 1500 wrote to memory of 1020	1500	f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe	start.exe
PID 1020 wrote to memory of 1084	1020	start.exe	ESETNOD.exe
PID 1020 wrote to memory of 1084	1020	start.exe	ESETNOD.exe
PID 1020 wrote to memory of 1084	1020	start.exe	ESETNOD.exe
PID 1020 wrote to memory of 1084	1020	start.exe	ESETNOD.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

start.exe

pid process

1020 start.exe
1020 start.exe
1020 start.exe
1020 start.exe
1020 start.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

start.exe

pid process

1020 start.exe
1020 start.exe
1020 start.exe
1020 start.exe
1020 start.exe

pid	process
1020	start.exe
1020	start.exe
1020	start.exe
1020	start.exe
1020	start.exe

pid	process
1020	start.exe
1020	start.exe
1020	start.exe
1020	start.exe
1020	start.exe

C:\Users\Admin\AppData\Local\Temp\f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe
"C:\Users\Admin\AppData\Local\Temp\f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ключи.txt
2⤵
PID:1616

C:\Users\Admin\AppData\Local\Temp\start.exe
"C:\Users\Admin\AppData\Local\Temp\start.exe"
2⤵
- Loads dropped DLL
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1020

C:\Users\Admin\AppData\Local\Temp\ESETNOD.exe
ESETNOD.exe
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1084

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ESETNOD.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\ESETNOD.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\ключи.txt

Download Submit
\Users\Admin\AppData\Local\Temp\ESETNOD.exe

Download Submit
\Users\Admin\AppData\Local\Temp\ESETNOD.exe

Download Submit
\Users\Admin\AppData\Local\Temp\start.exe

Download Submit
\Users\Admin\AppData\Local\Temp\start.exe

Download Submit
\Users\Admin\AppData\Local\Temp\start.exe

Download Submit
\Users\Admin\AppData\Local\Temp\start.exe

Download Submit
memory/1020-6-0x0000000000000000-mapping.dmp

Download
memory/1084-12-0x0000000000000000-mapping.dmp

Download
memory/1084-14-0x0000000002F60000-0x0000000002F64000-memory.dmp

Filesize
16KB

Download
memory/1084-15-0x0000000002B60000-0x0000000002B64000-memory.dmp

Filesize
16KB

Download
memory/1616-0-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads