Overview

overview

9

Static

static

VapeClient...es.exe

windows10-1703-x64

9

Resubmissions

04-12-2022 13:48

221204-q4k7msdh98 6

01-12-2022 10:08

221201-l6klnsgf89 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VapeClientExtractedFiles.exe

  • Size

    77.4MB

  • Sample

    221201-l6klnsgf89

  • MD5

    0b73f5d95f6c189782938606d19c7dd9

  • SHA1

    a317aadd08c87dd0447f84255e69e051383a9580

  • SHA256

    3690607313cef850d9df2f435d48f23b6569a539ae11111277cabe4dd807fa3a

  • SHA512

    684e4d855345db89527011b5a5bda77ae7489281d297d0ecfc46e6c2ea3ecca696e354dc0a7bae93d381cdb385abc6b633f458a3ecdd11586ffaf62cf0dfae45

  • SSDEEP

    1572864:22tc+1XlzYoiM31ZkU+xPmbhnn6kNO2F9BeakTSWF9ats+ssZ:HceFiM3x+tmZ6kNN9R5Dse

Score
9/10
evasionpyinstallerthemidatrojan

Malware Config

Targets

    • Target

      VapeClientExtractedFiles.exe

    • Size

      77.4MB

    • MD5

      0b73f5d95f6c189782938606d19c7dd9

    • SHA1

      a317aadd08c87dd0447f84255e69e051383a9580

    • SHA256

      3690607313cef850d9df2f435d48f23b6569a539ae11111277cabe4dd807fa3a

    • SHA512

      684e4d855345db89527011b5a5bda77ae7489281d297d0ecfc46e6c2ea3ecca696e354dc0a7bae93d381cdb385abc6b633f458a3ecdd11586ffaf62cf0dfae45

    • SSDEEP

      1572864:22tc+1XlzYoiM31ZkU+xPmbhnn6kNO2F9BeakTSWF9ats+ssZ:HceFiM3x+tmZ6kNN9R5Dse

    Score
    9/10
    evasionpyinstallerthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks