8860956c8e44c46a67a4325034d4c612aae7721c928668f5148e4a1bc5bf8779

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SetupX.exe
Size

2.0MB
MD5

a4900d9fe88f8ac892c383486088288c
SHA1

28c089bf25992b270a4e7039bc880ba520186976
SHA256

19e5e1df78d2545c13f25dfa94c33011822693461bba6c565d585a55b72343da
SHA512

2c3c17183ce2675e2eb729b7e8cd4a879f45c81dea5dbc918ad7a3f14ee81b0fc4872ed9ad23e0700412ed192750a0bc9910a9948d0103b5b592ad644d271711
SSDEEP

49152:P1vOOZdfm8KXVch7lkg1RF4UIFzUSAWSzGv:P18Vch7f1RFrIFzU1WSCv

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

SetupX.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SetupX.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SetupX.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SetupX.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SetupX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SetupX.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

SetupX.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SetupX.exe
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

SetupX.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Wine SetupX.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

26 iplogger.org
33 bitbucket.org
34 bitbucket.org
25 iplogger.org
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

SetupX.exe

pid process

1344 SetupX.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SetupX.exe

pid process

1344 SetupX.exe
1344 SetupX.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SetupX.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Wine	SetupX.exe

flow	ioc
26	iplogger.org
33	bitbucket.org
34	bitbucket.org
25	iplogger.org

pid	process
1344	SetupX.exe

pid	process
1344	SetupX.exe
1344	SetupX.exe

C:\Users\Admin\AppData\Local\Temp\SetupX.exe
"C:\Users\Admin\AppData\Local\Temp\SetupX.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1344

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\rfdertgvfd.exe
Filesize
14KB

MD5
de4e45444ac5679cd486f13407710ceb

SHA1
e4140efdc4785e73bbada092a085fe42cdc3f604

SHA256
91c9650d1b690d454bd3088791052bf78cdce1a309bb681898f0ee2643a967b3

SHA512
375a7c507ac4fa8032459d992c6fa059222b092128c6b5c5c316be49bdec8eb71782533f33fabad4a372139bbf76a3ed9c1decfcc415958509d46347ad8ba002

Download Submit
memory/1344-14-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-30-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-9-0x0000000000401000-0x000000000045D000-memory.dmp

Filesize
368KB

Download
memory/1344-8-0x0000000009FD0000-0x0000000009FD1000-memory.dmp

Filesize
4KB

Download
memory/1344-7-0x0000000009E60000-0x0000000009E61000-memory.dmp

Filesize
4KB

Download
memory/1344-5-0x0000000009E70000-0x0000000009E71000-memory.dmp

Filesize
4KB

Download
memory/1344-4-0x0000000009EB0000-0x0000000009EB1000-memory.dmp

Filesize
4KB

Download
memory/1344-3-0x0000000009E00000-0x0000000009E01000-memory.dmp

Filesize
4KB

Download
memory/1344-2-0x0000000009E80000-0x0000000009E81000-memory.dmp

Filesize
4KB

Download
memory/1344-10-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-11-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-12-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-42-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-6-0x0000000009E90000-0x0000000009E91000-memory.dmp

Filesize
4KB

Download
memory/1344-23-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-16-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-17-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-18-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-15-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-24-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-25-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-26-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-27-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-28-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-29-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-0-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1344-1-0x00000000773C4000-0x00000000773C6000-memory.dmp

Filesize
8KB

Download
memory/1344-13-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download