Malware Analysis Report

2025-05-28 16:27

Sample ID 230714-lwlqzsdh8x
Target OneTapCracked.rar
SHA256 e18e8474349b7f570726ff54c62ea8a304d5fcf70c3fceefb952f3a01c03ee7f
Tags
agilenet themida evasion trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e18e8474349b7f570726ff54c62ea8a304d5fcf70c3fceefb952f3a01c03ee7f

Threat Level: Known bad

The file OneTapCracked.rar was found to be: Known bad.

Malicious Activity Summary

agilenet themida evasion trojan

Suspicious use of NtCreateUserProcessOtherParentProcess

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Obfuscated with Agile.Net obfuscator

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-14 09:53

Signatures

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-14 09:53

Reported

2023-07-14 09:54

Platform

win10v2004-20230703-en

Max time kernel

18s

Max time network

26s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3160 created 3168 N/A C:\Users\Admin\AppData\Local\Temp\OneTapsu.exe C:\Windows\Explorer.EXE
PID 3160 created 3168 N/A C:\Users\Admin\AppData\Local\Temp\OneTapsu.exe C:\Windows\Explorer.EXE

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\OneTapsu.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\OneTapsu.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\OneTapsu.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\OneTapsu.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OneTapsu.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2420 wrote to memory of 452 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 2420 wrote to memory of 452 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 2420 wrote to memory of 3488 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 2420 wrote to memory of 3488 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 2420 wrote to memory of 3188 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 2420 wrote to memory of 3188 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 2420 wrote to memory of 1376 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 2420 wrote to memory of 1376 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\OneTapsu.exe

"C:\Users\Admin\AppData\Local\Temp\OneTapsu.exe"

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fvjzl#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Users\Admin\Google\Chrome\updater.exe

C:\Users\Admin\Google\Chrome\updater.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 126.21.238.8.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp

Files

memory/3160-134-0x00007FF77DA80000-0x00007FF77ECFD000-memory.dmp

memory/3160-133-0x00007FF77DA80000-0x00007FF77ECFD000-memory.dmp

memory/3160-135-0x00007FFD2B690000-0x00007FFD2B885000-memory.dmp

memory/3160-136-0x00007FF77DA80000-0x00007FF77ECFD000-memory.dmp

memory/3160-137-0x00007FF77DA80000-0x00007FF77ECFD000-memory.dmp

memory/3160-138-0x00007FF77DA80000-0x00007FF77ECFD000-memory.dmp

memory/3160-139-0x00007FF77DA80000-0x00007FF77ECFD000-memory.dmp

memory/3160-140-0x00007FFD2B690000-0x00007FFD2B885000-memory.dmp

memory/652-141-0x000001A73FDF0000-0x000001A73FE12000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wgl1e0kh.zho.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/652-151-0x00007FFD0C8C0000-0x00007FFD0D381000-memory.dmp

memory/652-152-0x000001A73FED0000-0x000001A73FEE0000-memory.dmp

memory/652-154-0x000001A73FED0000-0x000001A73FEE0000-memory.dmp

memory/652-153-0x000001A73FED0000-0x000001A73FEE0000-memory.dmp

memory/652-155-0x000001A73FED0000-0x000001A73FEE0000-memory.dmp

memory/652-158-0x00007FFD0C8C0000-0x00007FFD0D381000-memory.dmp

memory/3160-160-0x00007FF77DA80000-0x00007FF77ECFD000-memory.dmp

memory/3160-161-0x00007FFD2B690000-0x00007FFD2B885000-memory.dmp

C:\Users\Admin\Google\Chrome\updater.exe

MD5 a75d608c00aeee312660241f542e9d99
SHA1 9fc3fb2c7f644f3f7c694bdd201b0a93b5f42271
SHA256 5c9cd4e8addf667d8f5ff57328e5d3ba556e9697c61a3c2dcf2ac653ac249b2b
SHA512 c15d976a0a5888f6333b1b1c1e38634ceea4326f54df6ce7fc2f1ffa2c00a7c96bdf08f2726d7746f2216ec0e70b7ecf33cd2a838ecc05846ac7ded547835240

memory/3704-163-0x00007FF6E0630000-0x00007FF6E18AD000-memory.dmp

memory/3704-164-0x00007FFD2B690000-0x00007FFD2B885000-memory.dmp