b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9

General

Target

b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe
Size

2.6MB
MD5

0dc555d4301c1c53ec92326e3f8a8d57
SHA1

1b3d5e36dda0e2417f4d0cadd3955c5343154041
SHA256

b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9
SHA512

9e8ce3992d924715e955fb455c5ad1c455c5d21982f806b9db24833cdc76a0e563bf5bda7b4192a342283eafb0bd8a5f92a3a5602d5d7f8aa95e2010c66f9491

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 4 IoCs

Processes:

WScript.exe

flow pid process

13 1468 WScript.exe
14 1468 WScript.exe
15 1468 WScript.exe
16 1468 WScript.exe

flow	pid	process
13	1468	WScript.exe
14	1468	WScript.exe
15	1468	WScript.exe
16	1468	WScript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1772-57-0x00000000013E0000-0x0000000001AA4000-memory.dmp	themida
behavioral1/memory/1772-58-0x00000000013E0000-0x0000000001AA4000-memory.dmp	themida
behavioral1/memory/1772-59-0x00000000013E0000-0x0000000001AA4000-memory.dmp	themida
behavioral1/memory/1772-60-0x00000000013E0000-0x0000000001AA4000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe

pid process

1772 b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
4	ip-api.com

pid	process
1772	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe

pid process

1772 b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe

pid	process
1772	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe

description	pid	process	target process
PID 1772 wrote to memory of 432	1772	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe	WScript.exe
PID 1772 wrote to memory of 432	1772	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe	WScript.exe
PID 1772 wrote to memory of 432	1772	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe	WScript.exe
PID 1772 wrote to memory of 432	1772	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe	WScript.exe
PID 1772 wrote to memory of 1468	1772	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe	WScript.exe
PID 1772 wrote to memory of 1468	1772	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe	WScript.exe
PID 1772 wrote to memory of 1468	1772	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe	WScript.exe
PID 1772 wrote to memory of 1468	1772	b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe
"C:\Users\Admin\AppData\Local\Temp\b4c2a3b83c21343b81fcecfe1c828126017faed52fb990a4531ba04ad92dddb9.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bblwgpsgbmhw.vbs"
2⤵
PID:432

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ualxpmstspi.vbs"
2⤵
- Blocklisted process makes network request
PID:1468

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bblwgpsgbmhw.vbs
MD5
971a2cdb779104599bedc1579ebc94dc

SHA1
c8120b1b077b0395d32bdc1ef0907e0da6ebf0cc

SHA256
f40068183c7ec4066d184916649e4f298a13ab8e2b97c7c92a9adcf02fb6d08f

SHA512
0dd41292b0cbfca1049b3ac2748823d5edfde22b443bda4b1d84610d5e0385ca5c78795181e6e8c06d68480262b3623d3a359c113856184eccb6c06ab8fc19ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\ualxpmstspi.vbs
MD5
6eebf0c16fe5c47cc5d61f7f40bdb47e

SHA1
d87e0a19b8a1d7be0b01e8fb33390c7e012693bf

SHA256
cabd26333151480221e82f55cebda89c7e3f877a5f7932af59215c69d5116d4d

SHA512
dc12cca6a066fca6b728fbc578af89d9b42c5015b949f9efc4d9bd50ff2e171e6fd505008e222b5233bbd206ad340ba6d55123d2d12f967601e8d9b83b4606dd

Download Submit
memory/1772-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1772-57-0x00000000013E0000-0x0000000001AA4000-memory.dmp

Filesize
6.8MB

Download
memory/1772-56-0x00000000775A0000-0x00000000775A2000-memory.dmp

Filesize
8KB

Download
memory/1772-58-0x00000000013E0000-0x0000000001AA4000-memory.dmp

Filesize
6.8MB

Download
memory/1772-59-0x00000000013E0000-0x0000000001AA4000-memory.dmp

Filesize
6.8MB

Download
memory/1772-60-0x00000000013E0000-0x0000000001AA4000-memory.dmp

Filesize
6.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads