41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8

General

Target

41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe
Size

2.4MB
MD5

a287d97f20d4608c53d2bc5e9d64b94d
SHA1

b3a444db0d000a7905987dc445ecfee9bb3990fc
SHA256

41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8
SHA512

1a2324eaff128cc6d62686b565bb108b6b4aeab12d662d329ffcc327eac812958b48b8e0b6dc07f1fc3f30597775074db14f6ec556b34a6c8d75810281ac4260

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 4 IoCs

Processes:

WScript.exe

flow pid process

14 972 WScript.exe
15 972 WScript.exe
16 972 WScript.exe
17 972 WScript.exe

flow	pid	process
14	972	WScript.exe
15	972	WScript.exe
16	972	WScript.exe
17	972	WScript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1084-55-0x0000000001290000-0x00000000018FB000-memory.dmp	themida
behavioral1/memory/1084-56-0x0000000001290000-0x00000000018FB000-memory.dmp	themida
behavioral1/memory/1084-57-0x0000000001290000-0x00000000018FB000-memory.dmp	themida
behavioral1/memory/1084-58-0x0000000001290000-0x00000000018FB000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe

pid process

1084 41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
4	ip-api.com

pid	process
1084	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe

pid process

1084 41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe

pid	process
1084	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe

description	pid	process	target process
PID 1084 wrote to memory of 1620	1084	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe	WScript.exe
PID 1084 wrote to memory of 1620	1084	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe	WScript.exe
PID 1084 wrote to memory of 1620	1084	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe	WScript.exe
PID 1084 wrote to memory of 1620	1084	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe	WScript.exe
PID 1084 wrote to memory of 972	1084	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe	WScript.exe
PID 1084 wrote to memory of 972	1084	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe	WScript.exe
PID 1084 wrote to memory of 972	1084	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe	WScript.exe
PID 1084 wrote to memory of 972	1084	41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe
"C:\Users\Admin\AppData\Local\Temp\41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bmgrnxa.vbs"
2⤵
PID:1620

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\icxakurbmye.vbs"
2⤵
- Blocklisted process makes network request
PID:972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bmgrnxa.vbs
MD5
feeef645170eba02db91667734406d09

SHA1
dcf19d1cc0abf829dc985d081d17b49745bd2773

SHA256
298f9aa6663b9097eb81e5a852ab86ecd0695bf2eb4771044acb17f9e6cb09d7

SHA512
5a8c5b19d8159f56080112f7151e0aa43218c82d73610410d75130817112ef6090400471abfa405772de3f0438246565adadc6282b3262852aa69cde379c0bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\icxakurbmye.vbs
MD5
c784775ff9f265a5cd9ce6a6b705feef

SHA1
1cf95aea089cd5c965680f59dbb33950dd4c3ee9

SHA256
7c7314cb7379b955f1af48ddf76ebc85cfe4e0fcfc334d6c99a6fb55d400b91e

SHA512
2b3f28be3ecf18311559b6617c91dac9741dde11876fe2ce9de3b0f0e31ad4b62142a61cf40b51b8c51f88f07761624be6dfcb5e3dda6c6fe60e28ec0b312e6d

Download Submit
memory/1084-54-0x0000000075341000-0x0000000075343000-memory.dmp

Filesize
8KB

Download
memory/1084-55-0x0000000001290000-0x00000000018FB000-memory.dmp

Filesize
6.4MB

Download
memory/1084-56-0x0000000001290000-0x00000000018FB000-memory.dmp

Filesize
6.4MB

Download
memory/1084-57-0x0000000001290000-0x00000000018FB000-memory.dmp

Filesize
6.4MB

Download
memory/1084-58-0x0000000001290000-0x00000000018FB000-memory.dmp

Filesize
6.4MB

Download
memory/1084-59-0x0000000077440000-0x0000000077442000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads