Overview

overview

10

Static

static

7

793caa54c3...92.exe

windows7-x64

10

793caa54c3...92.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    793caa54c340a7e1bae20a67c31e5e4de8eccb7b2d52dd40817b3ddc20f47092

  • Size

    3.0MB

  • Sample

    221126-r414jabe45

  • MD5

    72109cd08d1f895968f827312e33f32d

  • SHA1

    25c131eb7a31591933043a682492661a530f309c

  • SHA256

    793caa54c340a7e1bae20a67c31e5e4de8eccb7b2d52dd40817b3ddc20f47092

  • SHA512

    277563d1033d19a5a310fc09fbc47e6c623ac18779369cf451f573a9fe9e2397d73c38e7e875b6e28a6fe9d1e7b04c248276df640ad95e41443738164d85ebba

  • SSDEEP

    49152:Nf4SFwur3lKsF8FcKqEfBcJOuR+Je49JHjQ04xmC304DA2Pc6duvjFIz:P3lFOcKqEfMO0Qr9JDH4xmCk4DW6duv+

Score
10/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      793caa54c340a7e1bae20a67c31e5e4de8eccb7b2d52dd40817b3ddc20f47092

    • Size

      3.0MB

    • MD5

      72109cd08d1f895968f827312e33f32d

    • SHA1

      25c131eb7a31591933043a682492661a530f309c

    • SHA256

      793caa54c340a7e1bae20a67c31e5e4de8eccb7b2d52dd40817b3ddc20f47092

    • SHA512

      277563d1033d19a5a310fc09fbc47e6c623ac18779369cf451f573a9fe9e2397d73c38e7e875b6e28a6fe9d1e7b04c248276df640ad95e41443738164d85ebba

    • SSDEEP

      49152:Nf4SFwur3lKsF8FcKqEfBcJOuR+Je49JHjQ04xmC304DA2Pc6duvjFIz:P3lFOcKqEfMO0Qr9JDH4xmCk4DW6duv+

    Score
    10/10
    evasionpersistencethemidatrojan

    • UAC bypass

      evasiontrojan

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

6
T1112

Virtualization/Sandbox Evasion

1
T1497

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks