Analysis
-
max time kernel
299s -
max time network
254s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 21:06
General
-
Target
YErb4fob3Zfa9s0ACYtpUHgyb.exe
-
Size
5.1MB
-
MD5
4eeb4851e21eb25d0b1532c75bc5d983
-
SHA1
c8c33cf9e2fa02402f06abd4d790e920146da60b
-
SHA256
6ad75992217a3b28bc5fe875016f8d13d83ac56730022b03341afb478179bbfa
-
SHA512
ca1d331175bd172811c255e98badd8244397b048454e736a94b4e2fd0cca4ab3455c3603a5953c3e26cec7493fdf23099126cd2808102c61d599d01d0ddc358e
-
SSDEEP
98304:dBb0vjPesuu2bphf6mXUljWBFAn29uzvBknCLpNoSm0fy5nq:/bATunfZXU9WB/9uzKny0q
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
YErb4fob3Zfa9s0ACYtpUHgyb.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ YErb4fob3Zfa9s0ACYtpUHgyb.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
YErb4fob3Zfa9s0ACYtpUHgyb.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion YErb4fob3Zfa9s0ACYtpUHgyb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion YErb4fob3Zfa9s0ACYtpUHgyb.exe -
Processes:
resource yara_rule behavioral1/memory/396-0-0x00007FF679C40000-0x00007FF67AA06000-memory.dmp themida behavioral1/memory/396-15-0x00007FF679C40000-0x00007FF67AA06000-memory.dmp themida behavioral1/memory/396-17-0x00007FF679C40000-0x00007FF67AA06000-memory.dmp themida behavioral1/memory/396-16-0x00007FF679C40000-0x00007FF67AA06000-memory.dmp themida behavioral1/memory/396-18-0x00007FF679C40000-0x00007FF67AA06000-memory.dmp themida behavioral1/memory/396-19-0x00007FF679C40000-0x00007FF67AA06000-memory.dmp themida behavioral1/memory/396-20-0x00007FF679C40000-0x00007FF67AA06000-memory.dmp themida behavioral1/memory/396-21-0x00007FF679C40000-0x00007FF67AA06000-memory.dmp themida behavioral1/memory/396-22-0x00007FF679C40000-0x00007FF67AA06000-memory.dmp themida -
Processes:
YErb4fob3Zfa9s0ACYtpUHgyb.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA YErb4fob3Zfa9s0ACYtpUHgyb.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
YErb4fob3Zfa9s0ACYtpUHgyb.exepid process 396 YErb4fob3Zfa9s0ACYtpUHgyb.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 2044 taskkill.exe 1560 taskkill.exe 2552 taskkill.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
YErb4fob3Zfa9s0ACYtpUHgyb.exepid process 396 YErb4fob3Zfa9s0ACYtpUHgyb.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2552 taskkill.exe Token: SeDebugPrivilege 2044 taskkill.exe Token: SeDebugPrivilege 1560 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
YErb4fob3Zfa9s0ACYtpUHgyb.execmd.execmd.execmd.exedescription pid process target process PID 396 wrote to memory of 2004 396 YErb4fob3Zfa9s0ACYtpUHgyb.exe cmd.exe PID 396 wrote to memory of 2004 396 YErb4fob3Zfa9s0ACYtpUHgyb.exe cmd.exe PID 2004 wrote to memory of 2552 2004 cmd.exe taskkill.exe PID 2004 wrote to memory of 2552 2004 cmd.exe taskkill.exe PID 396 wrote to memory of 2244 396 YErb4fob3Zfa9s0ACYtpUHgyb.exe cmd.exe PID 396 wrote to memory of 2244 396 YErb4fob3Zfa9s0ACYtpUHgyb.exe cmd.exe PID 2244 wrote to memory of 2044 2244 cmd.exe taskkill.exe PID 2244 wrote to memory of 2044 2244 cmd.exe taskkill.exe PID 396 wrote to memory of 968 396 YErb4fob3Zfa9s0ACYtpUHgyb.exe cmd.exe PID 396 wrote to memory of 968 396 YErb4fob3Zfa9s0ACYtpUHgyb.exe cmd.exe PID 968 wrote to memory of 1560 968 cmd.exe taskkill.exe PID 968 wrote to memory of 1560 968 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\YErb4fob3Zfa9s0ACYtpUHgyb.exe"C:\Users\Admin\AppData\Local\Temp\YErb4fob3Zfa9s0ACYtpUHgyb.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im KsDumperClient.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im KsDumper.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im HTTPDebuggerUI.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-0-0x00007FF679C40000-0x00007FF67AA06000-memory.dmpFilesize
13.8MB
-
memory/396-1-0x00007FFB18264000-0x00007FFB18265000-memory.dmpFilesize
4KB
-
memory/396-3-0x00007FFB18200000-0x00007FFB184C9000-memory.dmpFilesize
2.8MB
-
memory/396-4-0x00007FFB18200000-0x00007FFB184C9000-memory.dmpFilesize
2.8MB
-
memory/396-5-0x00007FFB18200000-0x00007FFB184C9000-memory.dmpFilesize
2.8MB
-
memory/396-14-0x00007FFB18200000-0x00007FFB184C9000-memory.dmpFilesize
2.8MB
-
memory/396-7-0x0000000180000000-0x0000000180020000-memory.dmpFilesize
128KB
-
memory/396-6-0x0000000180000000-0x0000000180020000-memory.dmpFilesize
128KB
-
memory/396-2-0x00007FFB18200000-0x00007FFB184C9000-memory.dmpFilesize
2.8MB
-
memory/396-15-0x00007FF679C40000-0x00007FF67AA06000-memory.dmpFilesize
13.8MB
-
memory/396-17-0x00007FF679C40000-0x00007FF67AA06000-memory.dmpFilesize
13.8MB
-
memory/396-16-0x00007FF679C40000-0x00007FF67AA06000-memory.dmpFilesize
13.8MB
-
memory/396-18-0x00007FF679C40000-0x00007FF67AA06000-memory.dmpFilesize
13.8MB
-
memory/396-19-0x00007FF679C40000-0x00007FF67AA06000-memory.dmpFilesize
13.8MB
-
memory/396-20-0x00007FF679C40000-0x00007FF67AA06000-memory.dmpFilesize
13.8MB
-
memory/396-21-0x00007FF679C40000-0x00007FF67AA06000-memory.dmpFilesize
13.8MB
-
memory/396-22-0x00007FF679C40000-0x00007FF67AA06000-memory.dmpFilesize
13.8MB
-
memory/396-23-0x00007FFB18200000-0x00007FFB184C9000-memory.dmpFilesize
2.8MB