Overview

overview

10

Static

static

7

1a35ad3297...72.exe

windows7_x64

9

1a35ad3297...72.exe

windows10-2004_x64

10

Resubmissions

09-02-2022 16:37

220209-t4xgfsbbcr 10

17-11-2021 14:03

211117-rcscbacha9 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a35ad3297d0ca9af31356f34f7b0c303ee19b52ecc4bfd249d806aa2bf7b072

  • Size

    4.5MB

  • Sample

    220209-t4xgfsbbcr

  • MD5

    7439ec7a2f65cd1a988e4e2cda98b0fc

  • SHA1

    23bc5a06e572362cf143f5580897336f609cf373

  • SHA256

    1a35ad3297d0ca9af31356f34f7b0c303ee19b52ecc4bfd249d806aa2bf7b072

  • SHA512

    20fbfe209431f9195d19677fd0664b610ef11238afcfb4619416553c4f48a3f228d97b9376ea96be811af7bc781151c2c1b2fcde2063877cfdc76fd2d703f8d2

Score
10/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      1a35ad3297d0ca9af31356f34f7b0c303ee19b52ecc4bfd249d806aa2bf7b072

    • Size

      4.5MB

    • MD5

      7439ec7a2f65cd1a988e4e2cda98b0fc

    • SHA1

      23bc5a06e572362cf143f5580897336f609cf373

    • SHA256

      1a35ad3297d0ca9af31356f34f7b0c303ee19b52ecc4bfd249d806aa2bf7b072

    • SHA512

      20fbfe209431f9195d19677fd0664b610ef11238afcfb4619416553c4f48a3f228d97b9376ea96be811af7bc781151c2c1b2fcde2063877cfdc76fd2d703f8d2

    Score
    10/10
    evasionthemidatrojan

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks