61458152c4215d24d3dd2b099a07916871d0ecc2dc3144106eb79e63182b2ae8

Resubmissions

30-11-2022 17:58

221130-wkdaksfb5v 9

30-11-2022 15:30

221130-sxknmscc77 9

Analysis

max time kernel
342s
max time network
461s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61458152c4215d24d3dd2b099a07916871d0ecc2dc3144106eb79e63182b2ae8.exe
Size

13.2MB
MD5

0a5659701d99b9076e067606bf36e0b7
SHA1

b1dbd42d7d25c01e19716f6e18614a51fbcacd47
SHA256

61458152c4215d24d3dd2b099a07916871d0ecc2dc3144106eb79e63182b2ae8
SHA512

26c99fa962b533428404f4cc3f528412ea7d0cc2bcd1ba7f6854ef7a61803af0203e16e5a1b480a467daee86cee8222f36791293b97fd9aa75e56febbcb56d56
SSDEEP

393216:qEZVtQ0b8LgVDBA4M8+4gFw2XGRbDyRyQ:qEZVtQ0Qez9cApuRy

Score

7^/10

evasion themida trojan

Malware Config

Signatures

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/3320-132-0x00007FF6238A0000-0x00007FF6259F6000-memory.dmp	themida
behavioral2/memory/3320-134-0x00007FF6238A0000-0x00007FF6259F6000-memory.dmp	themida
behavioral2/memory/3320-135-0x00007FF6238A0000-0x00007FF6259F6000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

61458152c4215d24d3dd2b099a07916871d0ecc2dc3144106eb79e63182b2ae8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	61458152c4215d24d3dd2b099a07916871d0ecc2dc3144106eb79e63182b2ae8.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

61458152c4215d24d3dd2b099a07916871d0ecc2dc3144106eb79e63182b2ae8.exe

pid process

3320 61458152c4215d24d3dd2b099a07916871d0ecc2dc3144106eb79e63182b2ae8.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3772 3320 WerFault.exe 61458152c4215d24d3dd2b099a07916871d0ecc2dc3144106eb79e63182b2ae8.exe

pid	process
3320	61458152c4215d24d3dd2b099a07916871d0ecc2dc3144106eb79e63182b2ae8.exe

pid	pid_target	process	target process
3772	3320	WerFault.exe	61458152c4215d24d3dd2b099a07916871d0ecc2dc3144106eb79e63182b2ae8.exe

C:\Users\Admin\AppData\Local\Temp\61458152c4215d24d3dd2b099a07916871d0ecc2dc3144106eb79e63182b2ae8.exe
"C:\Users\Admin\AppData\Local\Temp\61458152c4215d24d3dd2b099a07916871d0ecc2dc3144106eb79e63182b2ae8.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3320

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3320 -s 296
2⤵
- Program crash
PID:3772

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 3320 -ip 3320
1⤵
PID:936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3320-132-0x00007FF6238A0000-0x00007FF6259F6000-memory.dmp

Filesize
33.3MB

Download
memory/3320-133-0x00007FFAB6B90000-0x00007FFAB6D85000-memory.dmp

Filesize
2.0MB

Download
memory/3320-134-0x00007FF6238A0000-0x00007FF6259F6000-memory.dmp

Filesize
33.3MB

Download
memory/3320-135-0x00007FF6238A0000-0x00007FF6259F6000-memory.dmp

Filesize
33.3MB

Download