2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef

Analysis

max time kernel
118s
max time network
132s
platform
windows10_x64
resource
win10-en-20211208
submitted
22-12-2021 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Size

8.8MB
MD5

dc6b95b7a8982094af1c30e8c79aa1e4
SHA1

7c04bb06429040e3ed91d007f38b644df2bea45f
SHA256

2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef
SHA512

f0034093689df9df9975e73b16fe0ec361737ab2a3525f0e2836b5cbc29da1eeb740ebcd3f4b9e36f82be95bfc5a97d2c083013ef3e0ad6f41cc86db25aae4d3

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2544-116-0x0000000000400000-0x0000000001C06000-memory.dmp	themida
behavioral1/memory/2544-117-0x0000000000400000-0x0000000001C06000-memory.dmp	themida
behavioral1/memory/2544-118-0x0000000000400000-0x0000000001C06000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

pid process

2544 2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

pid	process
2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

description	pid	process
Token: SeDebugPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 1	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeCreateTokenPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeAssignPrimaryTokenPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeLockMemoryPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeIncreaseQuotaPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeMachineAccountPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeTcbPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeSecurityPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeTakeOwnershipPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeLoadDriverPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeSystemProfilePrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeSystemtimePrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeProfSingleProcessPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeIncBasePriorityPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeCreatePagefilePrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeCreatePermanentPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeBackupPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeRestorePrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeShutdownPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeDebugPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeAuditPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeSystemEnvironmentPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeChangeNotifyPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeRemoteShutdownPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeUndockPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeSyncAgentPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeEnableDelegationPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeManageVolumePrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeImpersonatePrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: SeCreateGlobalPrivilege	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 31	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 32	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 33	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 34	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 35	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 36	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 37	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 38	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 39	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 40	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 41	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 42	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 43	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 44	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 45	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 46	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 47	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
Token: 48	2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

pid	process
2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

pid	process
2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

pid	process
2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
2544	2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe

C:\Users\Admin\AppData\Local\Temp\2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe
"C:\Users\Admin\AppData\Local\Temp\2b53806e26eb21a166411ca916ec0efe5f1c2623d73fb6f55bbff1b8fb9d68ef.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2544-115-0x00000000774F0000-0x000000007767E000-memory.dmp

Filesize
1.6MB

Download
memory/2544-116-0x0000000000400000-0x0000000001C06000-memory.dmp

Filesize
24.0MB

Download
memory/2544-117-0x0000000000400000-0x0000000001C06000-memory.dmp

Filesize
24.0MB

Download
memory/2544-118-0x0000000000400000-0x0000000001C06000-memory.dmp

Filesize
24.0MB

Download
memory/2544-119-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-120-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-121-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-122-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-123-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-124-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-125-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-126-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-127-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-128-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-129-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-131-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-132-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-130-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-133-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-134-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-135-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-136-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-137-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-138-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-139-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-141-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-140-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-143-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-142-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-144-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-145-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-146-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-147-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-148-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-149-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-150-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-151-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-153-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-154-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-152-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-155-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-156-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-157-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-159-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-158-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-160-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-161-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-162-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-163-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-164-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-165-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-166-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-167-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-168-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-169-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-170-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-171-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-172-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-174-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-173-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-176-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-175-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-177-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-178-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-179-0x0000000000401000-0x000000000080D000-memory.dmp

Filesize
4.0MB

Download
memory/2544-536-0x0000000005F7C000-0x00000000060B9000-memory.dmp

Filesize
1.2MB

Download
memory/2544-535-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download
memory/2544-538-0x00000000042C0000-0x00000000042C1000-memory.dmp

Filesize
4KB

Download
memory/2544-537-0x00000000043B0000-0x00000000043B1000-memory.dmp

Filesize
4KB

Download
memory/2544-539-0x0000000005CF0000-0x0000000005CF1000-memory.dmp

Filesize
4KB

Download
memory/2544-540-0x0000000005D10000-0x0000000005D11000-memory.dmp

Filesize
4KB

Download
memory/2544-541-0x0000000005D30000-0x0000000005D31000-memory.dmp

Filesize
4KB

Download
memory/2544-543-0x00000000063D0000-0x00000000063D1000-memory.dmp

Filesize
4KB

Download
memory/2544-542-0x00000000063B0000-0x00000000063B1000-memory.dmp

Filesize
4KB

Download
memory/2544-544-0x0000000006400000-0x0000000006401000-memory.dmp

Filesize
4KB

Download
memory/2544-545-0x0000000006420000-0x0000000006421000-memory.dmp

Filesize
4KB

Download