d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9

General

Target

d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe
Size

2.7MB
MD5

56c1adc0374d7a9b4c490de2ac89f1a8
SHA1

d42e0f06b86f040ff945e4d94991101455299dd0
SHA256

d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9
SHA512

bee35ec98847c635a856d34bdfe4e7cf9c46af83de1e08710ef32136c81f5e6449a93241bc331dba6e8509c4665577f79d2768dbf4d272379800e0b9cf912311

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 4 IoCs

Processes:

WScript.exe

flow pid process

13 1792 WScript.exe
14 1792 WScript.exe
15 1792 WScript.exe
16 1792 WScript.exe

flow	pid	process
13	1792	WScript.exe
14	1792	WScript.exe
15	1792	WScript.exe
16	1792	WScript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1628-56-0x0000000000F50000-0x0000000001628000-memory.dmp	themida
behavioral1/memory/1628-57-0x0000000000F50000-0x0000000001628000-memory.dmp	themida
behavioral1/memory/1628-59-0x0000000000F50000-0x0000000001628000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe

pid process

1628 d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
4	ip-api.com

pid	process
1628	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe

pid process

1628 d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe

pid	process
1628	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe

description	pid	process	target process
PID 1628 wrote to memory of 620	1628	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe	WScript.exe
PID 1628 wrote to memory of 620	1628	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe	WScript.exe
PID 1628 wrote to memory of 620	1628	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe	WScript.exe
PID 1628 wrote to memory of 620	1628	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe	WScript.exe
PID 1628 wrote to memory of 1792	1628	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe	WScript.exe
PID 1628 wrote to memory of 1792	1628	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe	WScript.exe
PID 1628 wrote to memory of 1792	1628	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe	WScript.exe
PID 1628 wrote to memory of 1792	1628	d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe
"C:\Users\Admin\AppData\Local\Temp\d300285f78b79a708e1f15b6341d4131d3cc13fb26e27015fdb741bda7371ee9.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ebehsawciskd.vbs"
2⤵
PID:620

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jnyrhpluk.vbs"
2⤵
- Blocklisted process makes network request
PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Web Service

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ebehsawciskd.vbs
MD5
4ba96bbc72d3fefe2adeb89abe510f57

SHA1
d75217a24237088ea02c6dbcc14c399990f041fe

SHA256
6aaf4809b29426221a4d90559aa0ce47796baa4e77544c54a4646184ed0f8f1f

SHA512
f363ca142df879852c36a78fdef3a173befd94d6424a0253df25aef7e5da4d09079f950bf71fe8a6b26578cd371599702c1f7506331f498459f170ac8d7390ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\jnyrhpluk.vbs
MD5
905c274fa23bee034d8bc2f43b2dda89

SHA1
c8959cef46201e00a5aca7d78a54185e5ddc51e0

SHA256
fa33bc431a76164e6c7b2a6e12b16a12d6527b61c9fd5918acd8013b19ca95c4

SHA512
02e1846dc557593191681f6fb2e3dbdaedb9cbda562b5f053c65f51fa4080f379dd305aba9bbe9b5535896db7380d4f89bf472ec43d9eb456b1424f3960f3e1a

Download Submit
memory/1628-55-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1628-56-0x0000000000F50000-0x0000000001628000-memory.dmp

Filesize
6.8MB

Download
memory/1628-58-0x0000000077100000-0x0000000077102000-memory.dmp

Filesize
8KB

Download
memory/1628-57-0x0000000000F50000-0x0000000001628000-memory.dmp

Filesize
6.8MB

Download
memory/1628-59-0x0000000000F50000-0x0000000001628000-memory.dmp

Filesize
6.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads