Overview

overview

9

Static

static

7

main.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    main.exe

  • Size

    33.8MB

  • Sample

    220712-wnvc9sbgbm

  • MD5

    2869da8622f0bb95c21af1477bddefc4

  • SHA1

    614ad04b4b9e5ad2221559f930d591bb1580d011

  • SHA256

    7780aa377eb5bc90b71fd3a4f2d7ddd06a934371cef4b1af25e8bd5f112131bf

  • SHA512

    e05d747ad00b19daf94d109ce90c352ba30a0ed3ba39fe00381b9146b6830e080cdfccc68683c720c2d844ab82fbfc1c5b71b0fd4b619344653bdd47c9539626

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      main.exe

    • Size

      33.8MB

    • MD5

      2869da8622f0bb95c21af1477bddefc4

    • SHA1

      614ad04b4b9e5ad2221559f930d591bb1580d011

    • SHA256

      7780aa377eb5bc90b71fd3a4f2d7ddd06a934371cef4b1af25e8bd5f112131bf

    • SHA512

      e05d747ad00b19daf94d109ce90c352ba30a0ed3ba39fe00381b9146b6830e080cdfccc68683c720c2d844ab82fbfc1c5b71b0fd4b619344653bdd47c9539626

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks