52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191

General

Target

52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe
Size

2.6MB
MD5

db9f562738a4cd6adbfde0669264da02
SHA1

350c4acbd7a7b26e3ef5d4aaaecf660c7a8a07d1
SHA256

52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191
SHA512

35b7d1f9f40e49563092c523a0a27554d22e8587e3378aea46711d20c155ac2746d24c19c15c7db3a915480e04ef738d6d19cac6a5ce1c6b881a506b2ee968e7

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 4 IoCs

Processes:

WScript.exe

flow pid process

13 1860 WScript.exe
14 1860 WScript.exe
15 1860 WScript.exe
16 1860 WScript.exe

flow	pid	process
13	1860	WScript.exe
14	1860	WScript.exe
15	1860	WScript.exe
16	1860	WScript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/860-56-0x0000000000CF0000-0x00000000013BB000-memory.dmp	themida
behavioral1/memory/860-57-0x0000000000CF0000-0x00000000013BB000-memory.dmp	themida
behavioral1/memory/860-59-0x0000000000CF0000-0x00000000013BB000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe

pid process

860 52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
4	ip-api.com

pid	process
860	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe

pid process

860 52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe

pid	process
860	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe

description	pid	process	target process
PID 860 wrote to memory of 1104	860	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe	WScript.exe
PID 860 wrote to memory of 1104	860	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe	WScript.exe
PID 860 wrote to memory of 1104	860	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe	WScript.exe
PID 860 wrote to memory of 1104	860	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe	WScript.exe
PID 860 wrote to memory of 1860	860	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe	WScript.exe
PID 860 wrote to memory of 1860	860	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe	WScript.exe
PID 860 wrote to memory of 1860	860	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe	WScript.exe
PID 860 wrote to memory of 1860	860	52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe
"C:\Users\Admin\AppData\Local\Temp\52ce26bf711a0d2ea410e325fdb0acc1b81d3305c421b0fa2a882780a0c7c191.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\kosbxfbrm.vbs"
2⤵
PID:1104

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\gasafhmfdve.vbs"
2⤵
- Blocklisted process makes network request
PID:1860

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gasafhmfdve.vbs
MD5
d875ae806ab7c54faa5c777be2ac682d

SHA1
7a95cb8bcaa9189de78f1269816eac5c9b9c9f3f

SHA256
d3a01a49767e314654921bf273378393630755302ac909e9859b6e7517a5565e

SHA512
bef6f30bcba36c0b84e8c8262fb5b859a9a259e7e26be9d7adfc5e3a47ad756c24c07a28cd53a64869d839b19b57eba796dfe8c67fe8df8e04b1177bde7203f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\kosbxfbrm.vbs
MD5
036cb40684777852863a73e690b8cbc0

SHA1
cbc9fdd38c6ebc8991054d659d11ceda926ed217

SHA256
79c1c08a4443bdb7665a8b0d52b97ebfecdeba8b3098aee8c47683f0715456d0

SHA512
d5877e53cfe6ade539504b5c42a4bc45a60ec9f513f882a78655ad71247844897612a0e1c48f94e7e8dc078ef6438325810a046b1d2a338d5640b59cf1af4183

Download Submit
memory/860-55-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download
memory/860-56-0x0000000000CF0000-0x00000000013BB000-memory.dmp

Filesize
6.8MB

Download
memory/860-57-0x0000000000CF0000-0x00000000013BB000-memory.dmp

Filesize
6.8MB

Download
memory/860-58-0x0000000077790000-0x0000000077792000-memory.dmp

Filesize
8KB

Download
memory/860-59-0x0000000000CF0000-0x00000000013BB000-memory.dmp

Filesize
6.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads