Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-06-2024 20:15
Behavioral task
behavioral1
Sample
w/Glix.exe
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
w/cpr.dll
Resource
win11-20240611-en
Behavioral task
behavioral3
Sample
w/libcurl.dll
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
w/xxhash.dll
Resource
win11-20240611-en
Behavioral task
behavioral5
Sample
w/zlib1.dll
Resource
win11-20240419-en
Behavioral task
behavioral6
Sample
w/zstd.dll
Resource
win11-20240508-en
General
-
Target
w/Glix.exe
-
Size
3.8MB
-
MD5
045f740def841f8d26ccfbfe817875f9
-
SHA1
db2bdafff4932acca4c7ad606b1d7d4c47d6d0da
-
SHA256
e08cdc72c6a80a83a6ef55e23c4b89095470ef3eab91e99a8a5ff9e1aabf69c3
-
SHA512
d9a3fd84e9338e1b89559bbcb0ff3acc139b555614771e47a62ad9982c9a793c336a9fef82a330b58cd041b1a105eb33b753a2232bcf81d308068e35042a7d5f
-
SSDEEP
98304:bvUzB93cgv7DjQ/uhu1pLVaszNYdHjfdIzsYNIKZrXJcO:Al9cgUOurRasJYdfdIo0I8rXeO
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
Processes:
Glix.exeGlix.exeGlix.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Glix.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Glix.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Glix.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Glix.exeGlix.exeGlix.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Glix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Glix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Glix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Glix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Glix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Glix.exe -
Processes:
resource yara_rule behavioral1/memory/5044-2-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/5044-1-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/5044-4-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/5044-3-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/5044-5-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/5044-7-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/2452-9-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/2452-11-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/2452-10-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/2452-12-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/2452-13-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/2452-14-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/2400-19-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/2400-17-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/2400-18-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/2400-20-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/2400-21-0x0000000140000000-0x0000000140A7A000-memory.dmp themida behavioral1/memory/2400-22-0x0000000140000000-0x0000000140A7A000-memory.dmp themida -
Processes:
Glix.exeGlix.exeGlix.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Glix.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Glix.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Glix.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
Glix.exeGlix.exeGlix.exepid process 5044 Glix.exe 2452 Glix.exe 2400 Glix.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\w\Glix.exe"C:\Users\Admin\AppData\Local\Temp\w\Glix.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\w\Glix.exe"C:\Users\Admin\AppData\Local\Temp\w\Glix.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\w\Glix.exe"C:\Users\Admin\AppData\Local\Temp\w\Glix.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2400-16-0x00007FFB184A0000-0x00007FFB186A9000-memory.dmpFilesize
2.0MB
-
memory/2400-22-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/2400-23-0x00007FFB184A0000-0x00007FFB186A9000-memory.dmpFilesize
2.0MB
-
memory/2400-21-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/2400-20-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/2400-18-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/2400-17-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/2400-19-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/2452-10-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/2452-9-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/2452-8-0x00007FFB184A0000-0x00007FFB186A9000-memory.dmpFilesize
2.0MB
-
memory/2452-12-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/2452-13-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/2452-15-0x00007FFB184A0000-0x00007FFB186A9000-memory.dmpFilesize
2.0MB
-
memory/2452-14-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/2452-11-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/5044-0-0x00007FFB18547000-0x00007FFB18549000-memory.dmpFilesize
8KB
-
memory/5044-7-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/5044-5-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/5044-3-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/5044-4-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/5044-1-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB
-
memory/5044-2-0x0000000140000000-0x0000000140A7A000-memory.dmpFilesize
10.5MB