828e97849947eac4a9ca96aade810bc90564831d648a6b16c0c7902e465e6b74

Analysis

max time kernel
44s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SERVER~1.exe
Size

1.8MB
MD5

264df844abb71f9a049a52fe119a12d6
SHA1

8fd1ff9fce8a02a4b5b434e67bd02d268ca0b955
SHA256

dee0020e745a6bd0eb21c46136e9573502ec8e3e9f785a99f3a3a6936c53b7be
SHA512

ac8c8faec9e7a311b14d30b4849ef725aa77d406c082078ca23c9415e2275fba30a58dcd2c0929bccece976b161d3bb006a3c91d916df8ad85d49cf4d3689300
SSDEEP

49152:ZGR0ojUWvEtjD85JoQFbbKLT9f7B9BZW4Oj1:Zw00UaQDSJoQFXKLT9TB9Bw1

Score

7^/10

evasion themida

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

SERVER~1.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Wine SERVER~1.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Wine	SERVER~1.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral3/memory/1052-54-0x0000000000400000-0x00000000005CC000-memory.dmp	themida
behavioral3/memory/1052-56-0x0000000000400000-0x00000000005CC000-memory.dmp	themida
behavioral3/memory/1052-61-0x0000000000400000-0x00000000005CC000-memory.dmp	themida

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SERVER~1.exe

pid process

1052 SERVER~1.exe
1052 SERVER~1.exe

pid	process
1052	SERVER~1.exe
1052	SERVER~1.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SERVER~1.exe

description	pid	process	target process
PID 1052 wrote to memory of 1188	1052	SERVER~1.exe	Explorer.EXE
PID 1052 wrote to memory of 1188	1052	SERVER~1.exe	Explorer.EXE
PID 1052 wrote to memory of 1188	1052	SERVER~1.exe	Explorer.EXE
PID 1052 wrote to memory of 1188	1052	SERVER~1.exe	Explorer.EXE
PID 1052 wrote to memory of 1188	1052	SERVER~1.exe	Explorer.EXE
PID 1052 wrote to memory of 1188	1052	SERVER~1.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188

C:\Users\Admin\AppData\Local\Temp\SERVER~1.exe
"C:\Users\Admin\AppData\Local\Temp\SERVER~1.exe"
2⤵
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1052

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-54-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/1052-55-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/1052-56-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/1052-57-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1052-61-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/1188-58-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download