Overview

overview

9

Static

static

7

0x00040000...35.exe

windows7_x64

9

0x00040000...35.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0x0004000000000737-135.dat

  • Size

    2.7MB

  • Sample

    220706-wn87eshha5

  • MD5

    2e1b5bd5993ed556f63c440064f6680e

  • SHA1

    09569ebfbdc6c8467230c63c2c2bb49ae3357880

  • SHA256

    00bd9c8c6e890b516f64cffae9a7a4602969fc22e8fbd0b412003c239ff3612a

  • SHA512

    abf9ce14be0e8bdfe3d2c07c2b94817ec4740e2d29c02a0de4def2a3265f610fc3de1ff289872aea175de0f2ab36213db7a0edba71dad210851a5c9f8ed7c8cc

Score
9/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      0x0004000000000737-135.dat

    • Size

      2.7MB

    • MD5

      2e1b5bd5993ed556f63c440064f6680e

    • SHA1

      09569ebfbdc6c8467230c63c2c2bb49ae3357880

    • SHA256

      00bd9c8c6e890b516f64cffae9a7a4602969fc22e8fbd0b412003c239ff3612a

    • SHA512

      abf9ce14be0e8bdfe3d2c07c2b94817ec4740e2d29c02a0de4def2a3265f610fc3de1ff289872aea175de0f2ab36213db7a0edba71dad210851a5c9f8ed7c8cc

    Score
    9/10
    evasionpersistencethemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks