Overview

overview

8

Static

static

7

289d9ceaf6...9e.exe

windows7-x64

8

289d9ceaf6...9e.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    289d9ceaf6530ab298972e364233604eeb0e5ab513c2c9153c9e52d5cf6b1e9e

  • Size

    698KB

  • Sample

    221019-vw421ahfgm

  • MD5

    917b037ccfe24c51c2d4deaa007995ad

  • SHA1

    91edcc2fb181c37a1920602079d6f68215203aa0

  • SHA256

    289d9ceaf6530ab298972e364233604eeb0e5ab513c2c9153c9e52d5cf6b1e9e

  • SHA512

    7eb4d87ad5a757d98a7fef619a0c226264f3b151e0f7bb50908cc40a87f2dda2e41951806bc4945ed069d46ab8b30254507e57537a88732e140932ee360a26fd

  • SSDEEP

    12288:tpr0l29vZ/knYYWTGpn2m6tsIlnQvf2UyYOUntaFQ6aH/db4:7rA2TYYHCpnpmQH2XYOUnETaH

Score
8/10
evasionpersistencethemida

Malware Config

Targets

    • Target

      289d9ceaf6530ab298972e364233604eeb0e5ab513c2c9153c9e52d5cf6b1e9e

    • Size

      698KB

    • MD5

      917b037ccfe24c51c2d4deaa007995ad

    • SHA1

      91edcc2fb181c37a1920602079d6f68215203aa0

    • SHA256

      289d9ceaf6530ab298972e364233604eeb0e5ab513c2c9153c9e52d5cf6b1e9e

    • SHA512

      7eb4d87ad5a757d98a7fef619a0c226264f3b151e0f7bb50908cc40a87f2dda2e41951806bc4945ed069d46ab8b30254507e57537a88732e140932ee360a26fd

    • SSDEEP

      12288:tpr0l29vZ/knYYWTGpn2m6tsIlnQvf2UyYOUntaFQ6aH/db4:7rA2TYYHCpnpmQH2XYOUnETaH

    Score
    8/10
    evasionpersistencethemida

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks