Overview

overview

9

Static

static

7

38e3ff2c1a...0f.exe

windows7_x64

9

38e3ff2c1a...0f.exe

windows10-2004_x64

9

Resubmissions

01-07-2022 14:29

220701-rtnqfsgbcp 9

01-07-2022 12:59

220701-p717lafbf4 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    38e3ff2c1ad395cc854e2b620adc1a0f

  • Size

    7.6MB

  • Sample

    220701-p717lafbf4

  • MD5

    38e3ff2c1ad395cc854e2b620adc1a0f

  • SHA1

    ff1f4c054615337476ec558d22c69f578c5a9af2

  • SHA256

    49a3b199025018458e69db1fcf9db5b7f9dd1f9e825c5ed94caff4103ad4fa0b

  • SHA512

    0bd5b7b8dd03f9099504d6271e2bcd4aac0fd8a24b6097ac71ce33328bf4e7c305183919c40c1a64271eebf48643040ad4d0f0311bcd04a5143f237e39f16d98

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      38e3ff2c1ad395cc854e2b620adc1a0f

    • Size

      7.6MB

    • MD5

      38e3ff2c1ad395cc854e2b620adc1a0f

    • SHA1

      ff1f4c054615337476ec558d22c69f578c5a9af2

    • SHA256

      49a3b199025018458e69db1fcf9db5b7f9dd1f9e825c5ed94caff4103ad4fa0b

    • SHA512

      0bd5b7b8dd03f9099504d6271e2bcd4aac0fd8a24b6097ac71ce33328bf4e7c305183919c40c1a64271eebf48643040ad4d0f0311bcd04a5143f237e39f16d98

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks