d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3

General

Target

d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe
Size

2.6MB
MD5

0591112928807f431a46e19b49ee80d7
SHA1

29e8358b83531dfe9ce3d1fd3556e3ae36f482dd
SHA256

d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3
SHA512

c4bed7ca5ccd4dad9ce7ade15a76218bcd2577a78aa34d6b3c6f2a4da65dadaa9c32f51bdb201afb9da0a39d62ea03490d968e52940ff29b363b72a2e542bcca

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 4 IoCs

Processes:

WScript.exe

flow pid process

13 1304 WScript.exe
14 1304 WScript.exe
15 1304 WScript.exe
16 1304 WScript.exe

flow	pid	process
13	1304	WScript.exe
14	1304	WScript.exe
15	1304	WScript.exe
16	1304	WScript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1452-55-0x0000000000D80000-0x000000000144F000-memory.dmp	themida
behavioral1/memory/1452-56-0x0000000000D80000-0x000000000144F000-memory.dmp	themida
behavioral1/memory/1452-58-0x0000000000D80000-0x000000000144F000-memory.dmp	themida
behavioral1/memory/1452-59-0x0000000000D80000-0x000000000144F000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe

pid process

1452 d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
4	ip-api.com

pid	process
1452	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe

pid process

1452 d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe

pid	process
1452	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe

description	pid	process	target process
PID 1452 wrote to memory of 1952	1452	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe	WScript.exe
PID 1452 wrote to memory of 1952	1452	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe	WScript.exe
PID 1452 wrote to memory of 1952	1452	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe	WScript.exe
PID 1452 wrote to memory of 1952	1452	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe	WScript.exe
PID 1452 wrote to memory of 1304	1452	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe	WScript.exe
PID 1452 wrote to memory of 1304	1452	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe	WScript.exe
PID 1452 wrote to memory of 1304	1452	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe	WScript.exe
PID 1452 wrote to memory of 1304	1452	d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe
"C:\Users\Admin\AppData\Local\Temp\d6fcd542f08a38318740d91912a671431de6b96e52e69e24fc2e7a25d7ea3ad3.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\iyegvtln.vbs"
2⤵
PID:1952

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xonllcsmli.vbs"
2⤵
- Blocklisted process makes network request
PID:1304

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\iyegvtln.vbs
MD5
6a8619f8a1aa0f32dcc99ad202e3f921

SHA1
f5d4f8ea2f104d3677695e9667f4d4ce27b5523f

SHA256
b6675499a5071dd27628a308fb542f7f2b89c6f7e547b59a786cb1c949b4868a

SHA512
83274363c89da11675a19c10836a39ca5f0f52a9454a87c3ce75dcb1b473c201c1384b4dd202e7e37f34a418812697a5bcb861d898ffb7d8cfd08c29ab220e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\xonllcsmli.vbs
MD5
58cdb2528900d551c2f44f2dc6e34531

SHA1
e3209cd5778a50415692142bff54529bad274fda

SHA256
a74ce3898cb210bcd811b2c3746d300d0943c5f5c66dedeb0f83a19df3b59474

SHA512
769c239ac7ccec497368f7cd7537ee2f69eab7184763984e2a0d71364d8e969e8d38d3a426a7d7c04e316995211a5d2b1e154066bccfe62b61ab520c0b9cdb31

Download Submit
memory/1452-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1452-55-0x0000000000D80000-0x000000000144F000-memory.dmp

Filesize
6.8MB

Download
memory/1452-57-0x0000000077590000-0x0000000077592000-memory.dmp

Filesize
8KB

Download
memory/1452-56-0x0000000000D80000-0x000000000144F000-memory.dmp

Filesize
6.8MB

Download
memory/1452-58-0x0000000000D80000-0x000000000144F000-memory.dmp

Filesize
6.8MB

Download
memory/1452-59-0x0000000000D80000-0x000000000144F000-memory.dmp

Filesize
6.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads