ac4f3f5419ba904e15370cdaa5999b764e139fe0029d643563503b7c6560b756

Analysis

max time kernel
112s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
07/03/2022, 19:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Main__File.exe
Size 3.8MB
Sample220307-xzpgtsaebn
SHA256 ac4f3f5419ba904e15370cdaa5999b764e139fe0029d643563503b7c6560b756
MD5 1ed83087be2b1284b30649a8da6a684d
SHA1 1ac6f1f0e7c9c068105ed97e25cdee72abd029ab
SHA512 0b18f961a77e1482e30b14a4d1ef63dfcca16dd41db09a47d0b23f9a2217688b50ecc88e3e4281009663c31ec1ec5c1a22b94bdc9398687d8af940230a5aed1d
MD5 SHA1 SHA512

Score

9^/10

discovery evasion spyware stealer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Main__File.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Main__File.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/3984-130-0x0000000000700000-0x0000000000FC2000-memory.dmp	themida
behavioral2/memory/3984-131-0x0000000000700000-0x0000000000FC2000-memory.dmp	themida
behavioral2/memory/3984-133-0x0000000000700000-0x0000000000FC2000-memory.dmp	themida
behavioral2/memory/3984-134-0x0000000000700000-0x0000000000FC2000-memory.dmp	themida
behavioral2/memory/3984-135-0x0000000000700000-0x0000000000FC2000-memory.dmp	themida
behavioral2/memory/3984-136-0x0000000000700000-0x0000000000FC2000-memory.dmp	themida
behavioral2/memory/3984-137-0x0000000000700000-0x0000000000FC2000-memory.dmp	themida
behavioral2/memory/3984-138-0x0000000000700000-0x0000000000FC2000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Main__File.exe

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3984-131-0x0000000000700000-0x0000000000FC2000-memory.dmp	autoit_exe
behavioral2/memory/3984-133-0x0000000000700000-0x0000000000FC2000-memory.dmp	autoit_exe
behavioral2/memory/3984-134-0x0000000000700000-0x0000000000FC2000-memory.dmp	autoit_exe
behavioral2/memory/3984-135-0x0000000000700000-0x0000000000FC2000-memory.dmp	autoit_exe
behavioral2/memory/3984-136-0x0000000000700000-0x0000000000FC2000-memory.dmp	autoit_exe
behavioral2/memory/3984-137-0x0000000000700000-0x0000000000FC2000-memory.dmp	autoit_exe
behavioral2/memory/3984-138-0x0000000000700000-0x0000000000FC2000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3984	Main__File.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\cimv2	Main__File.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe
3984	Main__File.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3984	Main__File.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 2976	3984	Main__File.exe	59
PID 3984 wrote to memory of 2976	3984	Main__File.exe	59
PID 3984 wrote to memory of 2976	3984	Main__File.exe	59
PID 3984 wrote to memory of 3948	3984	Main__File.exe	61
PID 3984 wrote to memory of 3948	3984	Main__File.exe	61
PID 3984 wrote to memory of 3948	3984	Main__File.exe	61
PID 3984 wrote to memory of 1396	3984	Main__File.exe	68
PID 3984 wrote to memory of 1396	3984	Main__File.exe	68
PID 3984 wrote to memory of 1396	3984	Main__File.exe	68
PID 3984 wrote to memory of 2188	3984	Main__File.exe	70
PID 3984 wrote to memory of 2188	3984	Main__File.exe	70
PID 3984 wrote to memory of 2188	3984	Main__File.exe	70
PID 3984 wrote to memory of 3060	3984	Main__File.exe	72
PID 3984 wrote to memory of 3060	3984	Main__File.exe	72
PID 3984 wrote to memory of 3060	3984	Main__File.exe	72
PID 3984 wrote to memory of 1928	3984	Main__File.exe	74
PID 3984 wrote to memory of 1928	3984	Main__File.exe	74
PID 3984 wrote to memory of 1928	3984	Main__File.exe	74
PID 3984 wrote to memory of 1768	3984	Main__File.exe	76
PID 3984 wrote to memory of 1768	3984	Main__File.exe	76
PID 3984 wrote to memory of 1768	3984	Main__File.exe	76
PID 3984 wrote to memory of 3708	3984	Main__File.exe	78
PID 3984 wrote to memory of 3708	3984	Main__File.exe	78
PID 3984 wrote to memory of 3708	3984	Main__File.exe	78
PID 3984 wrote to memory of 1764	3984	Main__File.exe	80
PID 3984 wrote to memory of 1764	3984	Main__File.exe	80
PID 3984 wrote to memory of 1764	3984	Main__File.exe	80
PID 3984 wrote to memory of 3168	3984	Main__File.exe	82
PID 3984 wrote to memory of 3168	3984	Main__File.exe	82
PID 3984 wrote to memory of 3168	3984	Main__File.exe	82
PID 3984 wrote to memory of 1936	3984	Main__File.exe	84
PID 3984 wrote to memory of 1936	3984	Main__File.exe	84
PID 3984 wrote to memory of 1936	3984	Main__File.exe	84
PID 3984 wrote to memory of 3364	3984	Main__File.exe	86
PID 3984 wrote to memory of 3364	3984	Main__File.exe	86
PID 3984 wrote to memory of 3364	3984	Main__File.exe	86
PID 3984 wrote to memory of 3272	3984	Main__File.exe	88
PID 3984 wrote to memory of 3272	3984	Main__File.exe	88
PID 3984 wrote to memory of 3272	3984	Main__File.exe	88
PID 3984 wrote to memory of 3608	3984	Main__File.exe	90
PID 3984 wrote to memory of 3608	3984	Main__File.exe	90
PID 3984 wrote to memory of 3608	3984	Main__File.exe	90
PID 3984 wrote to memory of 2584	3984	Main__File.exe	92
PID 3984 wrote to memory of 2584	3984	Main__File.exe	92
PID 3984 wrote to memory of 2584	3984	Main__File.exe	92
PID 3984 wrote to memory of 1556	3984	Main__File.exe	94
PID 3984 wrote to memory of 1556	3984	Main__File.exe	94
PID 3984 wrote to memory of 1556	3984	Main__File.exe	94

C:\Users\Admin\AppData\Local\Temp\Main__File.exe
"C:\Users\Admin\AppData\Local\Temp\Main__File.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\Desktop\*.txt" "C:\Users\Admin\AppData\Local\Temp\1764\_Files"
  2⤵
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "C:\Users\Admin\wallet.dat" /S /B /A-D
  2⤵
  PID:3948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "C:\Users\Admin\UTC--2*" /S /B /A-D
  2⤵
  PID:1396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Web Data" "C:\Users\Admin\AppData\Local\Temp\1764\_Chrome\default_webdata.db"
  2⤵
  PID:2188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\1764\_Chrome\default_logins.db"
  2⤵
  PID:3060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Cookies" "C:\Users\Admin\AppData\Local\Temp\1764\_Chrome\default_cookies.db"
  2⤵
  PID:1928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Network\Cookies" "C:\Users\Admin\AppData\Local\Temp\1764\_Chrome\default_cookies.db"
  2⤵
  PID:1768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "C:\Users\Admin\AppData\Local\Temp\1764\_Edge\default_webdata.db"
  2⤵
  PID:3708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\1764\_Edge\default_logins.db"
  2⤵
  PID:1764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "C:\Users\Admin\AppData\Local\Temp\1764\_Edge\default_cookies.db"
  2⤵
  PID:3168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/0zrgtpmj.Admin\formhistory.sqlite" "C:\Users\Admin\AppData\Local\Temp\1764\_Firefox\formhistory.sqlite"
  2⤵
  PID:1936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/0zrgtpmj.Admin\cookies.sqlite" "C:\Users\Admin\AppData\Local\Temp\1764\_Firefox\cookies.sqlite"
  2⤵
  PID:3364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/0zrgtpmj.Admin\signons.sqlite" "C:\Users\Admin\AppData\Local\Temp\1764\_Firefox\signons.sqlite"
  2⤵
  PID:3272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/0zrgtpmj.Admin\logins.json" "C:\Users\Admin\AppData\Local\Temp\1764\_Firefox\logins.json"
  2⤵
  PID:3608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/0zrgtpmj.Admin\key3.db" "C:\Users\Admin\AppData\Local\Temp\1764\_Firefox\key3.db"
  2⤵
  PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/0zrgtpmj.Admin\key4.db" "C:\Users\Admin\AppData\Local\Temp\1764\_Firefox\key4.db"
  2⤵
  PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3984-138-0x0000000000700000-0x0000000000FC2000-memory.dmp

Download

memory/3984-136-0x0000000000700000-0x0000000000FC2000-memory.dmp

Download

memory/3984-137-0x0000000000700000-0x0000000000FC2000-memory.dmp

Download

memory/3984-130-0x0000000000700000-0x0000000000FC2000-memory.dmp

Download

memory/3984-139-0x0000000004160000-0x0000000004161000-memory.dmp

Download

memory/3984-140-0x0000000005360000-0x0000000005361000-memory.dmp

Download

memory/3984-141-0x0000000004C50000-0x0000000004C51000-memory.dmp

Download

memory/3984-142-0x0000000005370000-0x0000000005371000-memory.dmp

Download

memory/3984-135-0x0000000000700000-0x0000000000FC2000-memory.dmp

Download

memory/3984-134-0x0000000000700000-0x0000000000FC2000-memory.dmp

Download

memory/3984-132-0x00000000775D0000-0x0000000077773000-memory.dmp

Download

memory/3984-133-0x0000000000700000-0x0000000000FC2000-memory.dmp

Download

memory/3984-131-0x0000000000700000-0x0000000000FC2000-memory.dmp

Download