Analysis
-
max time kernel
22s -
max time network
26s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-06-2024 21:40
General
-
Target
REFLEX_V3.exe
-
Size
5.7MB
-
MD5
177ce961679d6ef708bdd1d6a24724e5
-
SHA1
55be52bff20821d00cbc9a09ba21edef98aadf46
-
SHA256
d8a6e6ed914c5e3fb8ce3b5e49eb12f99008a4f13dbad9d9c3e6b64dfdd5bf98
-
SHA512
c96d62701bdc212bb626e2ca3ecaceabd40a9f55f2779416a03e51d25bc5a0ff8c83727cb9aa8bc6a50f7efb1a9a00c2c2eb74b1fafa81cecdce0542c483b768
-
SSDEEP
98304:Sf914CcbNkOTh/HXwb7E/Ge7IO7aPmBdW/r3NBrzgoEIqy6iRnOQ48qFA:Sfz4Txt3wbqaIZE/r3NqoEdyVzeq
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
REFLEX_V3.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ REFLEX_V3.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
REFLEX_V3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion REFLEX_V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion REFLEX_V3.exe -
Processes:
resource yara_rule behavioral1/memory/5064-0-0x0000000140000000-0x0000000140E67000-memory.dmp themida behavioral1/memory/5064-1-0x0000000140000000-0x0000000140E67000-memory.dmp themida behavioral1/memory/5064-3-0x0000000140000000-0x0000000140E67000-memory.dmp themida behavioral1/memory/5064-2-0x0000000140000000-0x0000000140E67000-memory.dmp themida behavioral1/memory/5064-6-0x0000000140000000-0x0000000140E67000-memory.dmp themida behavioral1/memory/5064-26-0x0000000140000000-0x0000000140E67000-memory.dmp themida behavioral1/memory/5064-31-0x0000000140000000-0x0000000140E67000-memory.dmp themida -
Processes:
REFLEX_V3.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA REFLEX_V3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
REFLEX_V3.exepid process 5064 REFLEX_V3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
REFLEX_V3.exepid process 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe 5064 REFLEX_V3.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
REFLEX_V3.execmd.exedescription pid process target process PID 5064 wrote to memory of 2084 5064 REFLEX_V3.exe cmd.exe PID 5064 wrote to memory of 2084 5064 REFLEX_V3.exe cmd.exe PID 2084 wrote to memory of 4828 2084 cmd.exe certutil.exe PID 2084 wrote to memory of 4828 2084 cmd.exe certutil.exe PID 2084 wrote to memory of 3308 2084 cmd.exe find.exe PID 2084 wrote to memory of 3308 2084 cmd.exe find.exe PID 2084 wrote to memory of 3100 2084 cmd.exe find.exe PID 2084 wrote to memory of 3100 2084 cmd.exe find.exe PID 5064 wrote to memory of 3020 5064 REFLEX_V3.exe cmd.exe PID 5064 wrote to memory of 3020 5064 REFLEX_V3.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\REFLEX_V3.exe"C:\Users\Admin\AppData\Local\Temp\REFLEX_V3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\REFLEX_V3.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\REFLEX_V3.exe" MD53⤵
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5064-0-0x0000000140000000-0x0000000140E67000-memory.dmpFilesize
14.4MB
-
memory/5064-1-0x0000000140000000-0x0000000140E67000-memory.dmpFilesize
14.4MB
-
memory/5064-3-0x0000000140000000-0x0000000140E67000-memory.dmpFilesize
14.4MB
-
memory/5064-2-0x0000000140000000-0x0000000140E67000-memory.dmpFilesize
14.4MB
-
memory/5064-4-0x00007FFB18C07000-0x00007FFB18C09000-memory.dmpFilesize
8KB
-
memory/5064-5-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-7-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-6-0x0000000140000000-0x0000000140E67000-memory.dmpFilesize
14.4MB
-
memory/5064-8-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-9-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-11-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-10-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-12-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-13-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-14-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-15-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-16-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-18-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-17-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-19-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-20-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-21-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-22-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-23-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-24-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-25-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-27-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-26-0x0000000140000000-0x0000000140E67000-memory.dmpFilesize
14.4MB
-
memory/5064-30-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB
-
memory/5064-31-0x0000000140000000-0x0000000140E67000-memory.dmpFilesize
14.4MB
-
memory/5064-32-0x00007FFB18B60000-0x00007FFB18D69000-memory.dmpFilesize
2.0MB