561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283

General

Target

561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe
Size

2.5MB
MD5

17e6b50e6b3bd0ed3c3d7bb319e5c3bb
SHA1

5ee76f504a953ce4d801100a1621033e6c4fe3f6
SHA256

561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283
SHA512

6db1eb445485889795196cd87c6631b08b3a9da7c2ca37b7bf806b44ff6f5f37715d2fef6cc29e5a7b5c3995d011b0c610ff7c73a41a5f466f7d9fbe1705920f

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 4 IoCs

Processes:

WScript.exe

flow pid process

13 1304 WScript.exe
14 1304 WScript.exe
15 1304 WScript.exe
16 1304 WScript.exe

flow	pid	process
13	1304	WScript.exe
14	1304	WScript.exe
15	1304	WScript.exe
16	1304	WScript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1448-55-0x0000000000AD0000-0x0000000001148000-memory.dmp	themida
behavioral1/memory/1448-56-0x0000000000AD0000-0x0000000001148000-memory.dmp	themida
behavioral1/memory/1448-57-0x0000000000AD0000-0x0000000001148000-memory.dmp	themida
behavioral1/memory/1448-58-0x0000000000AD0000-0x0000000001148000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe

pid process

1448 561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
4	ip-api.com

pid	process
1448	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe

pid process

1448 561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe

pid	process
1448	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe

description	pid	process	target process
PID 1448 wrote to memory of 308	1448	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe	WScript.exe
PID 1448 wrote to memory of 308	1448	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe	WScript.exe
PID 1448 wrote to memory of 308	1448	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe	WScript.exe
PID 1448 wrote to memory of 308	1448	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe	WScript.exe
PID 1448 wrote to memory of 1304	1448	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe	WScript.exe
PID 1448 wrote to memory of 1304	1448	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe	WScript.exe
PID 1448 wrote to memory of 1304	1448	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe	WScript.exe
PID 1448 wrote to memory of 1304	1448	561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe
"C:\Users\Admin\AppData\Local\Temp\561986fd98e2ef79cfab1b7c0ebc4185d4c1b0f101ff10fc086d30fb6f02d283.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\indidbuxep.vbs"
2⤵
PID:308

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\imnpxrhwqo.vbs"
2⤵
- Blocklisted process makes network request
PID:1304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Web Service

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\imnpxrhwqo.vbs

MD5
48511d9e8cdd43aa84e7dd679e1a98d4

SHA1
6b71d2ae3ccdc8ec474d3e11335db81f7babc414

SHA256
958665186aa638e82b4ed52fcc091cadbb048be22cf8c10cb7412d033e69eda5

SHA512
d8838401ec9a0a70d030729472a320d8834f6dbe20462cf598e08570a98c3bbb26e4b6244e2bfd18258986d52cd0ce2a38d84aa1d8d804bf02c672ec59308d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\indidbuxep.vbs

MD5
6c2765a0e7a081ce9bfa5fef148c21fd

SHA1
2b4c1908d1457b3ece6e4721b522f0fb16a0d6a7

SHA256
f0648a1dd3b6ea3aaf7170904ed4c679aba61c1d45d3452c7e5868b95d6dc5ac

SHA512
94fdbc217383e8596babdf0d4ea873d84bf5e9b1edda63cd003365cda1833db2d8ee6076492f4ae3d3208e2bc3a905042127731847fba33da00e8f3fe93b14bd

Download Submit
memory/1448-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1448-55-0x0000000000AD0000-0x0000000001148000-memory.dmp

Filesize
6.5MB

Download
memory/1448-56-0x0000000000AD0000-0x0000000001148000-memory.dmp

Filesize
6.5MB

Download
memory/1448-57-0x0000000000AD0000-0x0000000001148000-memory.dmp

Filesize
6.5MB

Download
memory/1448-58-0x0000000000AD0000-0x0000000001148000-memory.dmp

Filesize
6.5MB

Download
memory/1448-59-0x0000000077590000-0x0000000077592000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads