ur s r

s dr d d rs r d s r d s s d w r s r s Eur

r d s r r rs r d d d s s d ur r ds s w r d r sur s s d d s s s s r d

r E s r Eur

w r s s dr r us d ss r u r d w r us rs w s us d rr du d w u d r w r r d r s r w r s u d w r r d

s rs s r s d ws d s d d ss r d rus s u s rr w s d r r d s u s us s d u s d d d w r r r d rs rr ss d u s w r w s u d s r s s rd r s w r

w r w s r s d s r d s s I s r s s r us s s drs d s d u d rs w s s d ss s d r r s ur s

d d s w r s d r d s s u d w w r d d urr r

w r s ss s w s wr r d s d r d s d u s r u z d s s

r s s d s u s su s I d d z s w r w ss u u s

w w s E 201 113 d E 2015 1 01 w r u d s s w s ss

s rs r s s w r s ur u s s ur s wwww z s u ur r ss r s s s ud r r r s rs d

I I s s ru w r s w s ss s w r s d r ss w r ur r ss s s w u d s ru z d r d s r rs d s s w u d u d

w rd d d ddr ss s r d r s ddr ss s u u 6 u r s ur d sw r rds s w r ur r s ru s s w ddr ss s

s w I Nt* and Rtl* d d r s s s INT 2Eh d CALL ntdll!KiFastSystemCallw r us d ss us r s s us d rus s w r d s d s s s d s r s r s u r

s w Is d s s s r u d u d u d r d u d d w d r rs sd ws u d rs d s u s s r w d ws r r d

s r rs r d r s d ws r s s

us d r su r u s u s s s r ss d u d s s u d s wu r s r s s u d d r s s ss

s z d s ru s d r s r u r rus r du s

r w E u

s s r s r r us s r I s d r u d r u s s s wr ur r I s ds s rus s w r s d w r u d d s su d r d

I s u s s w d s s r us rs d d s d r w r rd s s r s r u s r d d r r u r s s r s

u r ss s d r r us us r

855 8683 33 du

r s

s s s r rus s w r r ru s d s s sus ru s d s r r w w r s s r ud d s E 201 113 d E

2015 1 01 s w s ss w r us d u r d s r r ss s s r s r s w usr r d s d s r r s s ru s d s r r w dd urr us rd s r r r u w d s r r ss u ur

s w wr s s N r d s r u r d s r ntdll.dll Iw ru u r ss w r s d ws su s s s r z d d r rr d s kernel32.dll d user32.dll s N s dd N r r

C:\Windows\Temp:1 us w s r r ws rs explorer.exe Ns r s r d ru u r u s SetupExecute d BootExecute r s r

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\\

sur su ss N s w r r dr rs r ru r r r rss d r s r r s r dr rs r us rus s w r r d w r ss ru s d

s r s dr rs r d d r r ss d u d r r w u N

s s s w r d r w N ru N s s s r s sru s d d w r r ur w s d d

N s s r rus s w r s s d s s d dr s d rudur r ss d r r r w s d r us s N s u r rs s rus s r s us rus s w r s ru N r wr s

d s d s u d r rdpinst.exe d r s rs ru r r ss r r s ru \Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

r urr s r s ru ur s d s s ru ur s s u rs r r r s dr u rs s r s r r s s s r r d r s E s ur

r r w r s s s s s ru ur s ss d s rs r r s r u r

r u d r s r d us s r d r s s r r s r s rr r r s s s d s d r r ss s r d s r s r r d ss d rs r r r u r d s us r du s

I ud d s r d r r r r s r s r d d r ss d d d ws N Iw ss d 6 u r E 201 113

rs u s s dr rs s I d d s r u s d N u s s d r

u s d r ur r r ss w w r d s d sr ur ddr ss s

r u r s z E r r s d u w I d s r us s ddr ssu w s r d z d

N d s ddr ss d r u s I s d r w r d u u s r

d u N r I d E H d r d Subsystem d r 1 2 s dsu s s us d r r Native WindowsGUI s w r ru r u s s d s d srr r ss

d u s s d u r d s s r d us wssw rd d r s d r d u d r d N r

s u r sd r sd s r s s r r rs ur s ur u u 1 56 1 26 sd r r r

d s r s ru u rssu r u s

r d r s r s s r r s r u r d

s r r r r s s d s d r d r r r d s r s d sN u ss d 6 r E 201 113 ur r r N

r s r r s r ss d d r d d

r rr d d r ss d s r r us d r s s s

u s s r s r r d s u r us su r s ws s s sr w r

u ds s rw u r s d r s s d r rus s s d u w

w u d u r r u s u r u d s d s d r du s

s r us d u r s s sI w r ru r u s d r u d r u s s r d s d rr urI w r r w rus r du s s d r u d d s rs d

r dw s s s s r r s rd r r u d

Is s s s s s s r r d I s w u d rd r r u z s d s d d usI s ru w u d ru s d d ru s s rs w sur s d

w u d s w d r ss r s s r s d s ss s us d sr r d s d r r u 86 s ru I w r r ur s s

s ru s r us d w ur s r su r d d I d I s ru ru ur s d s us s s s ru d r s r u I s ru su d d r s r E s 0 80000002 0 80000003 r 0 8000000 s r s rs E E E d E wr du r d r I r d s r s u d s s s r ss w r ur r

r s I w r E 0 8000000

Intel(R) Xeon(R) CPUCommon KVM processorCommon 32-bit KVMVirtual CPUIntel Celeron_4x0 (Conroe/Merom Class Core 2)Westmere E56xx/L56xx/X56xx (Nehalem-C)Intel Core 2 Duo P9xxx (Penryn Class Core 2)Intel Core i7 9xx (Nehalem Class Core i7)Intel Xeon E312xx (Sandy Bridge)AMD Opteron 240 (Gen 1 Class Opteron)AMD Opteron 22xx (Gen 2 Class Opteron)AMD Opteron 23xx (Gen 3 Class Opteron)AMD Opteron 62xx class CPUIntel CPU version

s s r s u r s r s us d d E

# kvm -cpu ?x86 qemu64 QEMU Virtual CPU version 2.4.0x86 phenom AMD Phenom(tm) 9550 Quad-Core Processorx86 core2duo Intel(R) Core(TM)2 Duo CPU T7700 @ 2.40GHzx86 kvm64 Common KVM processorx86 qemu32 QEMU Virtual CPU version 2.4.0x86 kvm32 Common 32-bit KVM processorx86 coreduo Genuine Intel(R) CPU T2600 @ 2.16GHzx86 486x86 pentiumx86 pentium2x86 pentium3x86 athlon QEMU Virtual CPU version 2.4.0x86 n270 Intel(R) Atom(TM) CPU N270 @ 1.60GHzx86 Conroe Intel Celeron_4x0 (Conroe/Merom Class Core 2)x86 Penryn Intel Core 2 Duo P9xxx (Penryn Class Core 2)x86 Nehalem Intel Core i7 9xx (Nehalem Class Core i7)x86 Westmere Westmere E56xx/L56xx/X56xx (Nehalem-C)x86 SandyBridge Intel Xeon E312xx (Sandy Bridge)x86 IvyBridge Intel Xeon E3-12xx v2 (Ivy Bridge)x86 Haswell-noTSX Intel Core Processor (Haswell, no TSX)x86 Haswell Intel Core Processor (Haswell)x86 Broadwell-noTSX Intel Core Processor (Broadwell, no TSX)x86 Broadwell Intel Core Processor (Broadwell)x86 Opteron_G1 AMD Opteron 240 (Gen 1 Class Opteron)x86 Opteron_G2 AMD Opteron 22xx (Gen 2 Class Opteron)x86 Opteron_G3 AMD Opteron 23xx (Gen 3 Class Opteron)x86 Opteron_G4 AMD Opteron 62xx class CPUx86 Opteron_G5 AMD Opteron 63xx class CPUx86 host KVM processor with all supported host features (only available in KVM mode)

I ss s s r s s r d s ru r r s

ur r r I s ru u d w r s r E s 0 0000000 s w r ur s r sr s r

s r I w r E 0 0000000VMwareVMwareXenVMMXenVMMKVMKVMKVMprl hypervMicrosoft Hv

r u I u d I I s ru r s r 31 9 www d www u us d u s u s 6 32 r ur s s w r d rs ru s r r u 325383 d

H ss s s s s I r su GetComputerNameW() s u d s r ss

r sbrbrb-d8fb22af1jonathan-c561e0avreview1-VMXPvwinxp-maltestavreview-VMSunboxinfected-system

s s r s r s r su s su s r s s r s d s d s s s s r sus d r w r s s s s s s

GetModuleFileNameW() s s s s us d s d su s r s s s rC:\xxx\sample.exeC:\sample.exeC:\Shared\dum._vxeC:\SniferFiles\sample.exeC:\virus\virus.exeC:\virus.exec:\sampel.exeC:\setup.exeC:\runme.exec:\VMRun\Zample.exec:\FILE.EXEC:\run\temp.exec:\taskrun\samples\rtktst.exe.exec:\artifact.exeC:\manual\sunbox.exeC:\1.exe

r dmalware.exe\virus\admin\downloads\samp1e_sample_executionmlwr_smpl.exe

s r w r s r r'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\\xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxxxxx'

s r rs I s r r us s s d us s s r u r w s w rs dr s r s s r r s w d s ru r

d

r s ss d w us r s s u us d rus d w u d s d r d us r u s sus d s d s r rd ru rs r ss s w r ss s

r ss s w s s s r 32 d d d d r r ss d ss s s s w r d r d d ur u s d d d I u s

d r d r w s w d u s s s

rus r du s u z s u d r r s s s kernel32.dll r ntdll.dll s s usntdll.dll s ss r d r u r s r r wr r ntdll.dll u d w r s

d s d u d w kernel32.dll s r r d d s r d s w d u d N

us r r w d d ru us r s s su ss d rntdll.dll s d kernel32.dll us u d r ntdll.dll u s d

s w r d s ss d w us r s s s r ss sntdll!LdrGetDllHandle() s d r kernel32!GetModuleHandle() d r d

s r 32 r d d I ss d w s d s r d r r s rr d s d d s r du s

I s u d r su s s r d s u ur us u su r ss d r s u s d du z d

sNN dd rr

u 32 d d rd u u rd

u rd32 dw d uEH d ur

2 s32 d E s s

r d r s sI s s r d r r s r u d r ss r s r ur s s r ss d w s ds w r

C:\agent\agent.pywC:\sandbox\starter.exec:\ipf\BDCore_U.dllC:\cwsandbox_managerC:\cwsandboxC:\Stuff\odbg110C:\gfisandboxC:\Virus AnalysisC:\iDEFENSE\SysAnalyzerc:\gnu\binC:\SandCastle\toolsC:\cuckoo\dllC:\MDS\WinDump.exeC:\tsl\Raptorclient.exeC:\guest_tools\start.batC:\tools\aswsnx\snxcmd.exeC:\Winap\ckmon.pywc:\tools\decodezeusc:\tools\aswsnxC:\sandbox\starter.exeC:\Kit\procexp.exec:\tracer\mdare32_0.sysC:\tool\malmonC:\Samples\102114\Completedc:\vmremote\VmRemoteGuest.exed:\sandbox_svc.exe

Nu r r sr w I r du r d r w s s r d r r us H r s w I s u d r 1 r u

r s s r r s 1 r s ru s d r u

s d RtlGetNativeSystemInformation(SystemBasicInformation, ...) s w s structSYSTEM\_BASIC\_INFORMATION s ru s s d \_SYSTEM\_BASIC\_INFORMATION.NumberOfProcessors d us 1 d r du r d r r r d s u d r r r ss s r d

r d s r s r d'Intel(R) Core(TM) i7''Intel(R) Core(TM) i5''Intel(R) Core(TM) i3''Intel(R) Core(TM)2 Duo CPU'

N u r s I r E IN I N u s ur RtlGetNativeSystemInformation() s ss r NtQuerySystemInformation() d u d N r I u d u s ur structSYSTEM_BASIC_INFORMATION r s 32 rd d 3 00 0 s ru E I IN I N

r ss s r ss d w s w r us d u z s s

dir_watch.dlltracer.dllSbieDll.dllAPIOverride.dllNtHookEngine.dllapi_log.dllLOG_API.DLLLOG_API32.DLL

ntdll!LdrGetDllHandle() I s s r d d r ss r s

r r rN s I r s us N u r s I r s du I r

ntdll!RtlGetNativeSystemInformation(SystemModuleInformation, ...) s d s r ur s s d d r dr rs

E r du s r d s s r z d d r

I s dr rs r u d r ss w r

s ru ru ru s ss ru ru s sd d sI r s dr rs

s s sus s ss s

ur r ss r s s

ur s r r s sur r s sd d r sd s s

I w dr rs r u d s d s ru r r s u su H I dds s sds s ss ss s

ws s ss s

s s sE I

rsd s s360 s

360 s s360 6 s s360 r s s360 r 6 s s360 r s s360 H r s s360 H r6 s s360 s s

s w r N r urNd s s sNd s 6 s s

N r 360360 s s360 s s s

u I dr s ss s

d H s srus r z u

s s sr w rw 6 s sr r d s I dw s s sr sr s s sd s r s s

s ss ss s sdds s sd s sd s s

s rs1 s ss sd s ss s sd s su s s

rs s

Nd sI s sdw d6 s sdw d32 s s

r ss s

s z usw s ssw r s ssw dr2 s s

sw s sswNd s s ssw s ssw s ssw s sr r

s sr s ss ss s

E EE w s s

ww s ss s

dr s sw s s

s sdu s

r s ss s

s s sz ud s s sdsdr r s sd s su s s

r sss w u s w s u d r du

r ss s s u r d N s I r 5

5 r N E E IN I N I r ss w s s u d s r ss d s r rd d dr r d

s s w r u r r r s s s s r r ss d s s d d rus us s s r usu ru u s d r r s u d r s d

d r u r r r ss s s r s

su ru su ru sduur r r

r rdd

r ru

rs r r

udd

sr z rrrrsss s z rsr

sd

usrw r r

r r ss QueryFullProcessImageNameW() s d d r d s s d s I s rs urs u r ss r s

HE E EN N E E HEr r dur H 1 rd 1 r

ssr H 1 rr dd w r

Is N sI rus dus r s r r s s s s u s s d s ds d s r w u u s r s r us d r 5 H 1 d H 256

s s w r d s d s u s su w s s r su s u d s

Is w r s I s dN s s s w d r r s s I r s r ss s r d

r r s w r w r sr r s 86 w r w r s

H rd s d rdr s w r s r s r u r ds r E urr r E u I Es r E urr r E u Iu s r s s r u z d rd d s d rs

Ew r

d H r d r Iss r u

I u s u d s r ss s r d

s H rdw r d rs d I ss rdw r s r s r s r I s r ss r s

s r H E I Is r E urr r E u I H r u r 1s r E urr r E u I EN0000

s r E urr r E u EN E 02I s u \Registry\Machine\HARDWARE\DESCRIPTION\System\ s u r d d d s s s

s s rsH 1

11

d s rsr u

I s r s r s r ss s r d

N w r I r rd NIs s s d r du s ss d w r w r w r d d I ssu r w r d s Is s s us

s u NI s r s d d s IPHLPAPI!GetAdaptersInfo()

s d w us r ur r8139 I s E r NI

s us r ss d w ds s s

8139 s E r NIs us r ss d w ds s s

s w r rds w r d u rw r r d N d rr s r u us N w r d rr s H r N w r d r

d d r d r d d us d u r u d r sI w r rd s N s w ddr ss

w r r u E r d r r 8w r r u E r d r r 1r u H s E r d rs ddr ss s w r su r ur rddrddr ssss II II rr NN ss

00:01:02:03:04:xx 3 d u us usddr ss

00:03:FF:xx:xx:xx r s r r d s s rdw r00:0C:29:xx:xx:xx w r I08:00:27:xx:xx:xx d us u r s s r u00:07:e9:e4:ce:4d I 0 r su s00:30:18:ab:d7:f2 w I r

d 0 r su s00:ff:f2:f8:30:xx r u00:50:56:xx:xx:xx w r I52:54:00:12:34:56 s E s r u s r00:1c:42:xx:xx:xx r s I w r r du00:15:5d:xx:xx:xx r s r r00:1d:d8:xx:xx:xx r s r rI w u d w w w s 00 0 9 d d 00 30 18 d 2 I r ur s d s rd r r d s d d

d wrs w d w ss s d s r r d s u d s s s r ss s r d r ur s s

r us d s s d s r us d s d sdd ww ssss dd wwE s s r s

N IN s s r su ru s s s r s

w ss s s r s0 w s r s www s s r s0 r s r s www s s r s0 s r r s r s www s s r s0 r ss r s r s www s s r s

d d w r s rI E IN 0

0 100 r s ssd r u d0 r r s r s r du0 w r s r du0 d s s r r0 20 s r u u0 r u0 E 0 950 d r 0 I0 d r 6 53 I s r0 d r 56 r0 d r 560 s r w rr r ru d r 6 r s z rr E

00000 10011 6 35016 us d r 1 6 r N 86r s @ rus w r I

r rs d w ss r r r r

dd ww ssss dd ww

ss rr NN sss r E r s d ws urr rs s Ir s N w r r z rs r E r s d ws urr rs s I s r 2 5s r E r s d ws urr rs s s z r s1s r E r s d ws urr rs s 13 E68 1 98 8 9 22

3 6532531 I r 2s r E r s d ws urr rs s r r u u s

dd ss r E w6 32N d r s d ws urr rs s r

r u u s dd ss r E urr r E u I EN 80EE E EE 00000000 E 00 r u r s

r rss r E urr r E u I EN 80EE E E 00000000 E 00 r u u s

r r rss r E urr r E u I EN 5333 E 8811 00000000 E 00 3 d rd us d

r u ss r E urr r E u I EN 1 8 E 005 0 001 8 E 00 r s s

r rss r E urr r E u I EN 1 8 E 000 0 001 8 E 00 r s

r rss r E urr r E u I EN 1 8 E 006 0 061 8 E 00 r s r

r rs r E r s d ws urr rs s 25 16E5 8 55 83

8 9 600 5s s

d w rs r E w6 32N d r s d ws urr rs s Ir s N w r

r z rs r E w6 32N d r s d ws urr rs s s z r s1s r E w6 32N d r s d ws urr rs s I s r

2 5s r E w6 32N d r s d ws urr rs s 13 E68 1

98 8 9 22 3 6532531 I r 2s r E w6 32N d r s d ws urr rs s 25 16E5

8 55 83 8 9 600 5s s

d w r

rs s r r s w r r u I IN s ru w E s uIN s ru s r d s ru d u s d w r u s w u d r su r r u

u s d r u s u s r d r us s s s w r s u s s w r u s Is d u d r

s u d r s r

s s w s s

us s r us wr ss I ssu N s r w r s d

d s

r 3 d rds r 3 r s s u r r u s d d d rs I d rds rd rs r s r ss r ur r s d r sdd rIrI dd rr NN NN ss

0 15 d r I0 80 r r r u0 1013 rrus s d

Ed r sdd rIrI dd rr NN

0 8086 I0 10d N d0 1002N w us r s w s d s r s s ss d w s r s I s s

s s d GetCursorPosition() I r r 15 us s s ssu s ss d d u s u I r s 15 us s s us s w r s urur s w r d d s s r r d I s w r s d w u d s u s w

s d s u du s r r r d s w r dd du

ur s d s s us r us us r w r s us rw r s us urs r r u d

s s u z s d r s s s GetCursorPosition() s u w ss us r s sr us u

N rs r s d s d u s us r us r I s s r

s ru u rs r us r

s r s s r d d r ss d d s s d r wr d s N dr w d ws su s s s r d d I u r u r d d w d ws 2000 u w r r

s u d u r d s s r 32 N s r s ru s s s s su r d d w u d ru

r us s u u d d r

N r s wr s s s r r s ru s d s r s u rs I sus s r s s r r s d s d r ss d us

s r s s r r u r rus s w r I w s d host us d Nr r r rds r rus u d s r rs s 0.0.0.0 s w rus s d

r u d s d s

I s s dr d %SystemRoot%\rdpinst.exe d

sur ru s r u s r s r u\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

dd s r s s s r s w r r s u u s w d s r s ru d w

u rs

d s r r d d r r s s 2 s r r r H

u u ur

r d s H s d s w s nullptr

I r256256 66 9811 0 21 2 3 6 866 15d 0 11d dd 3 d 9 33 d6963

638d5 9 2 0 28 62 0880 3 9 9 13 60633d8 652028 0 916 5 0218 d N I r1 598 8 2d d88d3 0 60 829 12d 3 d rd s d6 3 295 6985251d 1 962 2 2 69 36 5 2 d ss d803 5 8 31 816855 d82 5 d68 3832d d 6 E 201 113

I u w r w r s r d w u d r r u s s d w u r us dw d d s s s

r du s u r r rs s ur s E s du

r 2016 s s r d r r s s