Overview

overview

7

Static

static

7

5577b6af29...71.exe

windows7-x64

7

5577b6af29...71.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5577b6af2967c973fe247348c7aba41cd505ff6bf8a6da201139c752b2407d71

  • Size

    585KB

  • Sample

    220725-tehxrshcgl

  • MD5

    ba9e0339088a770ab44ca3ee76926a52

  • SHA1

    162c48be7d14d4ae5a32090f5d98f8893ab1f007

  • SHA256

    5577b6af2967c973fe247348c7aba41cd505ff6bf8a6da201139c752b2407d71

  • SHA512

    310c827af36e8f3870e38872929d8a8147444c525b44890ed758aaa27c02de13609f0412f6cbf3a37e75bdb50289495e0a4d4ba53025e276a6e9be78d17c971b

Score
7/10
evasionthemida

Malware Config

Targets

    • Target

      5577b6af2967c973fe247348c7aba41cd505ff6bf8a6da201139c752b2407d71

    • Size

      585KB

    • MD5

      ba9e0339088a770ab44ca3ee76926a52

    • SHA1

      162c48be7d14d4ae5a32090f5d98f8893ab1f007

    • SHA256

      5577b6af2967c973fe247348c7aba41cd505ff6bf8a6da201139c752b2407d71

    • SHA512

      310c827af36e8f3870e38872929d8a8147444c525b44890ed758aaa27c02de13609f0412f6cbf3a37e75bdb50289495e0a4d4ba53025e276a6e9be78d17c971b

    Score
    7/10
    evasionthemida

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks