ac4f3f5419ba904e15370cdaa5999b764e139fe0029d643563503b7c6560b756

General

Target

Main__File.exe
Size

3.8MB
MD5

1ed83087be2b1284b30649a8da6a684d
SHA1

1ac6f1f0e7c9c068105ed97e25cdee72abd029ab
SHA256

ac4f3f5419ba904e15370cdaa5999b764e139fe0029d643563503b7c6560b756
SHA512

0b18f961a77e1482e30b14a4d1ef63dfcca16dd41db09a47d0b23f9a2217688b50ecc88e3e4281009663c31ec1ec5c1a22b94bdc9398687d8af940230a5aed1d

Score

9^/10

discovery evasion spyware stealer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Main__File.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Main__File.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Main__File.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1208-55-0x0000000000980000-0x0000000001242000-memory.dmp	themida
behavioral1/memory/1208-56-0x0000000000980000-0x0000000001242000-memory.dmp	themida
behavioral1/memory/1208-58-0x0000000000980000-0x0000000001242000-memory.dmp	themida
behavioral1/memory/1208-59-0x0000000000980000-0x0000000001242000-memory.dmp	themida
behavioral1/memory/1208-60-0x0000000000980000-0x0000000001242000-memory.dmp	themida
behavioral1/memory/1208-61-0x0000000000980000-0x0000000001242000-memory.dmp	themida
behavioral1/memory/1208-62-0x0000000000980000-0x0000000001242000-memory.dmp	themida
behavioral1/memory/1208-63-0x0000000000980000-0x0000000001242000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Main__File.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Main__File.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Main__File.exe

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1208-56-0x0000000000980000-0x0000000001242000-memory.dmp	autoit_exe
behavioral1/memory/1208-58-0x0000000000980000-0x0000000001242000-memory.dmp	autoit_exe
behavioral1/memory/1208-59-0x0000000000980000-0x0000000001242000-memory.dmp	autoit_exe
behavioral1/memory/1208-60-0x0000000000980000-0x0000000001242000-memory.dmp	autoit_exe
behavioral1/memory/1208-61-0x0000000000980000-0x0000000001242000-memory.dmp	autoit_exe
behavioral1/memory/1208-62-0x0000000000980000-0x0000000001242000-memory.dmp	autoit_exe
behavioral1/memory/1208-63-0x0000000000980000-0x0000000001242000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Main__File.exe

pid process

1208 Main__File.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
NTFS ADS 1 IoCs

Processes:

Main__File.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\cimv2 Main__File.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\cimv2	Main__File.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

Processes:

Main__File.exe

pid	process
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe
1208	Main__File.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Main__File.exe

pid process

1208 Main__File.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

Main__File.exe

description	pid	process	target process
PID 1208 wrote to memory of 768	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 768	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 768	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 768	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1104	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1104	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1104	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1104	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 560	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 560	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 560	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 560	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1940	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1940	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1940	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1940	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1664	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1664	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1664	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1664	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1692	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1692	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1692	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1692	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1564	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1564	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1564	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1564	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1852	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1852	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1852	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1852	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 968	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 968	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 968	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 968	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1572	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1572	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1572	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1572	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1556	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1556	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1556	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1556	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1656	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1656	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1656	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1656	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1180	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1180	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1180	1208	Main__File.exe	cmd.exe
PID 1208 wrote to memory of 1180	1208	Main__File.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Main__File.exe
"C:\Users\Admin\AppData\Local\Temp\Main__File.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\Desktop\*.txt" "C:\Users\Admin\AppData\Local\Temp\6644\_Files"
2⤵
PID:768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "C:\Users\Admin\wallet.dat" /S /B /A-D
2⤵
PID:1104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "C:\Users\Admin\UTC--2*" /S /B /A-D
2⤵
PID:560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Web Data" "C:\Users\Admin\AppData\Local\Temp\6644\_Chrome\default_webdata.db"
2⤵
PID:1940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\6644\_Chrome\default_logins.db"
2⤵
PID:1664

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Cookies" "C:\Users\Admin\AppData\Local\Temp\6644\_Chrome\default_cookies.db"
2⤵
PID:1692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Network\Cookies" "C:\Users\Admin\AppData\Local\Temp\6644\_Chrome\default_cookies.db"
2⤵
PID:1564

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/faxxuvis.Admin\formhistory.sqlite" "C:\Users\Admin\AppData\Local\Temp\6644\_Firefox\formhistory.sqlite"
2⤵
PID:1852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/faxxuvis.Admin\cookies.sqlite" "C:\Users\Admin\AppData\Local\Temp\6644\_Firefox\cookies.sqlite"
2⤵
PID:968

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/faxxuvis.Admin\signons.sqlite" "C:\Users\Admin\AppData\Local\Temp\6644\_Firefox\signons.sqlite"
2⤵
PID:1572

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/faxxuvis.Admin\logins.json" "C:\Users\Admin\AppData\Local\Temp\6644\_Firefox\logins.json"
2⤵
PID:1556

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/faxxuvis.Admin\key3.db" "C:\Users\Admin\AppData\Local\Temp\6644\_Firefox\key3.db"
2⤵
PID:1656

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/faxxuvis.Admin\key4.db" "C:\Users\Admin\AppData\Local\Temp\6644\_Firefox\key4.db"
2⤵
PID:1180

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6644\_Chrome\default_cookies.db
MD5
055c8c5c47424f3c2e7a6fc2ee904032

SHA1
5952781d22cff35d94861fac25d89a39af6d0a87

SHA256
531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

SHA512
c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\6644\_Chrome\default_logins.db
MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\6644\_Chrome\default_webdata.db
MD5
8ee018331e95a610680a789192a9d362

SHA1
e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

SHA256
94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

SHA512
4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\6644\_Files\DismountBackup.txt
MD5
8c40fa90dfcaace26fc7e7a042cc24fc

SHA1
829ebd32313afbf4552673c33eb39a8a5484dbb5

SHA256
dadd1db444824987b4ebc8195baf83a9dc751a718185cc1cd0e5199e956465f0

SHA512
9f3c97febfe3c192e54c3e68edfd486e0c0a3218867cfcae85194bad487cafdf8bdbe4f1a98a348c7a09b00dc504179c1235ae6f51f0bece4d9657f97bc1b283

Download Submit
memory/1208-62-0x0000000000980000-0x0000000001242000-memory.dmp

Filesize
8.8MB

Download
memory/1208-66-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/1208-60-0x0000000000980000-0x0000000001242000-memory.dmp

Filesize
8.8MB

Download
memory/1208-61-0x0000000000980000-0x0000000001242000-memory.dmp

Filesize
8.8MB

Download
memory/1208-54-0x0000000075CC1000-0x0000000075CC3000-memory.dmp

Filesize
8KB

Download
memory/1208-63-0x0000000000980000-0x0000000001242000-memory.dmp

Filesize
8.8MB

Download
memory/1208-65-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/1208-59-0x0000000000980000-0x0000000001242000-memory.dmp

Filesize
8.8MB

Download
memory/1208-64-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/1208-67-0x0000000001350000-0x0000000001351000-memory.dmp

Filesize
4KB

Download
memory/1208-58-0x0000000000980000-0x0000000001242000-memory.dmp

Filesize
8.8MB

Download
memory/1208-56-0x0000000000980000-0x0000000001242000-memory.dmp

Filesize
8.8MB

Download
memory/1208-57-0x0000000077450000-0x00000000775D0000-memory.dmp

Filesize
1.5MB

Download
memory/1208-55-0x0000000000980000-0x0000000001242000-memory.dmp

Filesize
8.8MB

Download
memory/1208-72-0x0000000003080000-0x0000000003081000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads