Overview

overview

9

Static

static

7

SerenityCh...1).exe

windows7-x64

9

SerenityCh...1).exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SerenityCheats_IW4Controller (1).exe

  • Size

    2.9MB

  • Sample

    221003-efbgragcfm

  • MD5

    4e8b30b5baaef875933585a627388115

  • SHA1

    bc2ea94e1cbccbc0d3222eb209c0d8ea1ba43b3f

  • SHA256

    e0250b327194023b91395240fb3a5791be1e6bf0ba0288fecc1b6a0f406e26e1

  • SHA512

    36bd4dd46a09d12702d4b124253ef6c486201dab343ffc05871b60db01455484ddf3ab2768a1aa7f706f560ed0d792f6e9e34b172c32cf7618cade88fcb83b3f

  • SSDEEP

    49152:+QcR5TidZggH0hG8Y6/W1BVxMY0YsA8Y7ah/bDdxGuScyv0Df46XEWFoJW0nN9p3:RcHTKgXhG86BVxMPYsA8LvdxGugv0E6S

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      SerenityCheats_IW4Controller (1).exe

    • Size

      2.9MB

    • MD5

      4e8b30b5baaef875933585a627388115

    • SHA1

      bc2ea94e1cbccbc0d3222eb209c0d8ea1ba43b3f

    • SHA256

      e0250b327194023b91395240fb3a5791be1e6bf0ba0288fecc1b6a0f406e26e1

    • SHA512

      36bd4dd46a09d12702d4b124253ef6c486201dab343ffc05871b60db01455484ddf3ab2768a1aa7f706f560ed0d792f6e9e34b172c32cf7618cade88fcb83b3f

    • SSDEEP

      49152:+QcR5TidZggH0hG8Y6/W1BVxMY0YsA8Y7ah/bDdxGuScyv0Df46XEWFoJW0nN9p3:RcHTKgXhG86BVxMPYsA8LvdxGugv0E6S

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks