4887444aab8abf18bf9757238b7ed8e40ba0b1d5db5c51fc694b69af963867e9

Resubmissions

14-08-2022 23:47

220814-3s5s5abgdr 7

14-08-2022 22:16

220814-168e3adgd5 7

Analysis

max time kernel
48s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2022 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4887444aab8abf18bf9757238b7ed8e40ba0b1d5db5c51fc694b69af963867e9.exe
Size

7.2MB
MD5

83a880033ab0d346e9cdc81ab060e177
SHA1

9a18f55adad011a7dfeac109ed63dbb50d02461c
SHA256

4887444aab8abf18bf9757238b7ed8e40ba0b1d5db5c51fc694b69af963867e9
SHA512

b84b5e6897f2fa626a0886c69caae580c4b5892248c31d6437d9d660100d21a757ce28f2db311c2ebd21fb232c010f2fd12d9e2b136737b986f14ff548f41c1b

Score

7^/10

evasion themida trojan

Malware Config

Signatures

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/4332-132-0x0000000000400000-0x0000000001078000-memory.dmp	themida
behavioral2/memory/4332-134-0x0000000000400000-0x0000000001078000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

4887444aab8abf18bf9757238b7ed8e40ba0b1d5db5c51fc694b69af963867e9.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4887444aab8abf18bf9757238b7ed8e40ba0b1d5db5c51fc694b69af963867e9.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

4887444aab8abf18bf9757238b7ed8e40ba0b1d5db5c51fc694b69af963867e9.exe

pid process

4332 4887444aab8abf18bf9757238b7ed8e40ba0b1d5db5c51fc694b69af963867e9.exe

pid	process
4332	4887444aab8abf18bf9757238b7ed8e40ba0b1d5db5c51fc694b69af963867e9.exe

C:\Users\Admin\AppData\Local\Temp\4887444aab8abf18bf9757238b7ed8e40ba0b1d5db5c51fc694b69af963867e9.exe
"C:\Users\Admin\AppData\Local\Temp\4887444aab8abf18bf9757238b7ed8e40ba0b1d5db5c51fc694b69af963867e9.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4332-132-0x0000000000400000-0x0000000001078000-memory.dmp

Filesize
12.5MB

Download
memory/4332-133-0x00007FF8D20D0000-0x00007FF8D22C5000-memory.dmp

Filesize
2.0MB

Download
memory/4332-134-0x0000000000400000-0x0000000001078000-memory.dmp

Filesize
12.5MB

Download
memory/4332-135-0x00007FF8D20D0000-0x00007FF8D22C5000-memory.dmp

Filesize
2.0MB

Download