82a8b539cef9ef4e6709f01fbeefb4a14618805a3e23c717255f87b69d014ee8

Analysis

max time kernel
141s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2023, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Evo-gen.15553.14900.dll
Size 9.0MB
Sample230118-p2cbaahb26
SHA256 82a8b539cef9ef4e6709f01fbeefb4a14618805a3e23c717255f87b69d014ee8
MD5 cd615d0674d70c46da0be8bdf7993380
SHA1 b713680f617fad5efd034bd983190c57475a8fb3
SHA512 6de56cb160f98360d82904cc62234e0dc2657d28e351c0ae2fe0eaa91c0d186e457ea05250cc0577f54f7bdf4da369a182e85ceb4c85744836de9a380ba2338b
SSDEEP 196608:1Nm4bmKn0fLGXjA6Ke5BY4HgvjgpUK6eDYHPaNLeMJS:PbF0qXjxK4BY4Av8eK6xYeu
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
1524	rundll32.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/1524-133-0x0000000002390000-0x0000000003ABC000-memory.dmp	themida
behavioral2/memory/1524-134-0x0000000002390000-0x0000000003ABC000-memory.dmp	themida
behavioral2/memory/1524-135-0x0000000002390000-0x0000000003ABC000-memory.dmp	themida
behavioral2/memory/1524-136-0x0000000002390000-0x0000000003ABC000-memory.dmp	themida
behavioral2/memory/1524-137-0x0000000002390000-0x0000000003ABC000-memory.dmp	themida
behavioral2/memory/1524-138-0x0000000002390000-0x0000000003ABC000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4540	1524	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 1524	3388	rundll32.exe	77
PID 3388 wrote to memory of 1524	3388	rundll32.exe	77
PID 3388 wrote to memory of 1524	3388	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.15553.14900.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.15553.14900.dll,#1
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Checks whether UAC is enabled
  PID:1524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 784
    3⤵
    - Program crash
    PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1524 -ip 1524
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6d2f800a.dll

Path C:\Users\Admin\AppData\Local\Temp\6d2f800a.dll
Size 8KB
SHA256 c09d0790e550694350b94ca6b077c54f983c135fab8990df5a75462804150912
MD5 d8f4ab8284f0fda871d6834e24bc6f37
SHA1 641948e44a1dcfd0ef68910768eb4b1ea6b49d10
SHA512 f65a916041846718306567d33273c3d0f41e0b26589cf6db46ec6c788ba0d87a708c94979d3bd0609142badca9e7129690b92169a07dcf7cd8c66698827d2fa0
SSDEEP 24:e1GSgMQIBU/Fxu4ZrzXW9UTdkgkhKh5aEH+/pI04UqPnRuV4MPgic:SgMFYO4ZrzXEjgkhKh5a++VYRuqS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1524-133-0x0000000002390000-0x0000000003ABC000-memory.dmp

Download

memory/1524-134-0x0000000002390000-0x0000000003ABC000-memory.dmp

Download

memory/1524-135-0x0000000002390000-0x0000000003ABC000-memory.dmp

Download

memory/1524-136-0x0000000002390000-0x0000000003ABC000-memory.dmp

Download

memory/1524-137-0x0000000002390000-0x0000000003ABC000-memory.dmp

Download

memory/1524-138-0x0000000002390000-0x0000000003ABC000-memory.dmp

Download

memory/1524-140-0x0000000061E00000-0x0000000061EC1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads