Overview

overview

9

Static

static

7

104dd8e3bf...b7.exe

windows7-x64

9

104dd8e3bf...b7.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    104dd8e3bf957c6cf7da52c546405ab7.exe

  • Size

    5.7MB

  • Sample

    221125-h8eawsag59

  • MD5

    104dd8e3bf957c6cf7da52c546405ab7

  • SHA1

    2623754939b50204e06d94ae62eb6afc6587f69a

  • SHA256

    dd6ab934b4c23d80a7a699d9ef55498d56115c86df0fa9ff73cfc1651c1b07c0

  • SHA512

    435f7b869769d3a1642c84f3b081c5e93e22c4fd96f7aa82c9d8201b539106bddc0b047348d92bc752a6d9afcd97bfe1e84eaa20a036d92593806de7adc99628

  • SSDEEP

    98304:NEp+KwDQdGp//3wHhGizimMxJlqyIZybWHOpjecBF7yx2h5UO1VQxznJZ531:NEp+fDQdGp3wBGgovqZfHOxtBB62DI

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      104dd8e3bf957c6cf7da52c546405ab7.exe

    • Size

      5.7MB

    • MD5

      104dd8e3bf957c6cf7da52c546405ab7

    • SHA1

      2623754939b50204e06d94ae62eb6afc6587f69a

    • SHA256

      dd6ab934b4c23d80a7a699d9ef55498d56115c86df0fa9ff73cfc1651c1b07c0

    • SHA512

      435f7b869769d3a1642c84f3b081c5e93e22c4fd96f7aa82c9d8201b539106bddc0b047348d92bc752a6d9afcd97bfe1e84eaa20a036d92593806de7adc99628

    • SSDEEP

      98304:NEp+KwDQdGp//3wHhGizimMxJlqyIZybWHOpjecBF7yx2h5UO1VQxznJZ531:NEp+fDQdGp3wBGgovqZfHOxtBB62DI

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks