a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99

Analysis

max time kernel
244s
max time network
358s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99.exe
Size

1.5MB
MD5

2b9c5f11da7a9d56eea7c6625e8c7b69
SHA1

14946e3e75d5d68dd376805e23e8c7cdc53d1d3e
SHA256

a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99
SHA512

bc586da529f9bc828d0edead55b3f976a6c4e692eec9da5b32f5f35adaf9c83fd5f91d14d3d4a69775097266d1718186463cf68e11cf650f843424a98246a8db
SSDEEP

24576:LyxPnMiWuR5nBlJCYpXBHdiJYQ1ohq8JNZ4zYWEMNa/o7NbBVBo8PbiWGqGZl7fx:Ly6i5hdCEXB9mYQ1oI6iEsNbdoSb2lzt

Score

7^/10

persistence themida

Malware Config

Signatures

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/940-56-0x0000000000400000-0x000000000070E000-memory.dmp	themida
behavioral1/memory/940-60-0x0000000000400000-0x000000000070E000-memory.dmp	themida
behavioral1/memory/268-61-0x0000000000400000-0x000000000070E000-memory.dmp	themida
behavioral1/memory/940-62-0x0000000000400000-0x000000000070E000-memory.dmp	themida
behavioral1/memory/940-63-0x0000000000400000-0x000000000070E000-memory.dmp	themida
behavioral1/files/0x000800000001231c-65.dat	themida
behavioral1/memory/940-66-0x0000000000400000-0x000000000070E000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NfquxeK = "c:\\ProgramData\\WjlepjK\\YfwgftG\\NfquxeK.exe"	notepad.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 268 set thread context of 940	268	a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
268	a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99.exe
940	notepad.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 268 wrote to memory of 940	268	a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99.exe	28
PID 268 wrote to memory of 940	268	a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99.exe	28
PID 268 wrote to memory of 940	268	a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99.exe	28
PID 268 wrote to memory of 940	268	a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99.exe	28
PID 268 wrote to memory of 940	268	a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99.exe	28
PID 268 wrote to memory of 940	268	a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99.exe	28

C:\Users\Admin\AppData\Local\Temp\a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99.exe
"C:\Users\Admin\AppData\Local\Temp\a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:268
- C:\Windows\SysWOW64\notepad.exe
  C:\Windows\system32\notepad.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\ProgramData\WjlepjK\YfwgftG\NfquxeK.exe

Filesize
1.5MB

MD5
2b9c5f11da7a9d56eea7c6625e8c7b69

SHA1
14946e3e75d5d68dd376805e23e8c7cdc53d1d3e

SHA256
a017266245443e4d00455478199f00ab40dc8bcf2cceb846894b99bfe5ba2e99

SHA512
bc586da529f9bc828d0edead55b3f976a6c4e692eec9da5b32f5f35adaf9c83fd5f91d14d3d4a69775097266d1718186463cf68e11cf650f843424a98246a8db

Download Submit
memory/268-59-0x0000000001FE0000-0x00000000020D1000-memory.dmp

Filesize
964KB

Download
memory/268-61-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/940-54-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/940-56-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/940-60-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/940-62-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/940-63-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/940-64-0x0000000000401000-0x0000000000449000-memory.dmp

Filesize
288KB

Download
memory/940-66-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download