Overview

overview

9

Static

static

7

first rele...am.exe

windows10-1703-x64

9

first rele...or.exe

windows10-1703-x64

1

first rele...om.dll

windows10-1703-x64

3

first rele...x.html

windows10-1703-x64

1

first rele...4c6.js

windows10-1703-x64

1

first rele...ff5.js

windows10-1703-x64

1

first rele...6c2.js

windows10-1703-x64

1

first rele...139.js

windows10-1703-x64

1

first rele...f4a.js

windows10-1703-x64

1

first rele...3ed.js

windows10-1703-x64

1

first rele...2cd.js

windows10-1703-x64

1

first rele...6c6.js

windows10-1703-x64

1

first rele...927.js

windows10-1703-x64

1

first rele...563.js

windows10-1703-x64

1

first rele...d05.js

windows10-1703-x64

1

first rele...1cc.js

windows10-1703-x64

1

first rele...ffe.js

windows10-1703-x64

1

first rele...dc1.js

windows10-1703-x64

1

first rele...de8.js

windows10-1703-x64

1

first rele...ll.bat

windows10-1703-x64

1

first rele...ver.py

windows10-1703-x64

3

first rele...rt.bat

windows10-1703-x64

1

Analysis

  • max time kernel
    46s
  • max time network
    62s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10-02-2023 18:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    first release/client/Dream.exe

  • Size

    11.0MB

  • MD5

    726f20dbd7ad8911d0e4e3641d6169a8

  • SHA1

    ee692681ba0ffbb2671bba80a9fa4a01ff104889

  • SHA256

    a5fd61f34eeba9e6a949a11be3b7a736c9c904978261cdd422181b34746d1d8c

  • SHA512

    a1d37e5f845d93ae064158471244f472a5c1908cd370605aa9422f2ef4bdc908099ee6697cbd87bb78bcb2dd7f2001b5a705b35da7a9788df39af86f30890126

  • SSDEEP

    196608:0uCcEILkwmDkQ4aDPWMac1CGuEEyG2hnDpdM8Bs1pXjZpo8pHDdCwJ6wuQ:0uCZCyk4fd1luKnDpRMtoUj3JzuQ

Score
9/10
evasionthemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\first release\client\Dream.exe
    "C:\Users\Admin\AppData\Local\Temp\first release\client\Dream.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtCreateThreadExHideFromDebugger
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2340
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2340 -s 712
      2⤵
      • Program crash
      PID:356

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2340-120-0x00007FF6FCC40000-0x00007FF6FE512000-memory.dmp

    Filesize

    24.8MB

    Download

  • memory/2340-121-0x00007FF9E92F0000-0x00007FF9E94CB000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2340-122-0x00007FF6FCC40000-0x00007FF6FE512000-memory.dmp

    Filesize

    24.8MB

    Download

  • memory/2340-123-0x00007FF6FCC40000-0x00007FF6FE512000-memory.dmp

    Filesize

    24.8MB

    Download

  • memory/2340-124-0x00007FF6FCC40000-0x00007FF6FE512000-memory.dmp

    Filesize

    24.8MB

    Download

  • memory/2340-125-0x00007FF6FCC40000-0x00007FF6FE512000-memory.dmp

    Filesize

    24.8MB

    Download

  • memory/2340-126-0x00007FF6FCC40000-0x00007FF6FE512000-memory.dmp

    Filesize

    24.8MB

    Download

  • memory/2340-127-0x00007FF6FCC40000-0x00007FF6FE512000-memory.dmp

    Filesize

    24.8MB

    Download

  • memory/2340-128-0x00007FF9E92F0000-0x00007FF9E94CB000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2340-129-0x00007FF9E92F0000-0x00007FF9E94CB000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2340-130-0x00007FF9E92F0000-0x00007FF9E94CB000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2340-131-0x00007FF6FCC40000-0x00007FF6FE512000-memory.dmp

    Filesize

    24.8MB

    Download