Overview

overview

9

Static

static

7

88d6f62def...e8.exe

windows7_x64

9

88d6f62def...e8.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88d6f62deff34565e1b0272f1554824091b2476af8e6f386647f6b85e7c9a2e8

  • Size

    3.3MB

  • Sample

    220215-kawtdscgc3

  • MD5

    0dfeb3b51850fc533a34dbc310b87102

  • SHA1

    29d424a7ad1be8cd11b29f51cc73b871f5ed48ee

  • SHA256

    88d6f62deff34565e1b0272f1554824091b2476af8e6f386647f6b85e7c9a2e8

  • SHA512

    7e34a418fb13ba6bb6e4f68c13c1fcc9911935f7226b63191eab36417166076a72a6d28a8b40ebee68d58d40ebd69057fd3e5d8b45d46b11366d8edf360457a6

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      88d6f62deff34565e1b0272f1554824091b2476af8e6f386647f6b85e7c9a2e8

    • Size

      3.3MB

    • MD5

      0dfeb3b51850fc533a34dbc310b87102

    • SHA1

      29d424a7ad1be8cd11b29f51cc73b871f5ed48ee

    • SHA256

      88d6f62deff34565e1b0272f1554824091b2476af8e6f386647f6b85e7c9a2e8

    • SHA512

      7e34a418fb13ba6bb6e4f68c13c1fcc9911935f7226b63191eab36417166076a72a6d28a8b40ebee68d58d40ebd69057fd3e5d8b45d46b11366d8edf360457a6

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks