2e07bcecb35c45358f2b2384c9299bb763d689af164f56cfb5f544fa7c8df7c4

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Buildd.exe
Size

4.8MB
MD5

97d3330e95fa3f646d06ba8e07044fcc
SHA1

0f5a7e83e8c0d7135340f6f64e81a9165c4408aa
SHA256

2e07bcecb35c45358f2b2384c9299bb763d689af164f56cfb5f544fa7c8df7c4
SHA512

a66c0f2820f34a56fd5649a9f3b5c0bcfd0ff21f597f0d13b015442b53114b9f70b9a6771dc50be00fed02ba6cf7eb9ff486e4e3ec19aaa4b3ea57dc2e14ed8e
SSDEEP

98304:9oruFP0NI452yaa9vs/uvvrgR44PSJghL7G9JcEAY36ddYPe:euFE4pa8u8RDSSL7G9eEQddYG

Score

8^/10

persistence themida

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2580-30-0x0000000000A40000-0x00000000016C0000-memory.dmp	themida
behavioral1/memory/2580-31-0x0000000000A40000-0x00000000016C0000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2580	Buildd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2580 set thread context of 2840	2580	Buildd.exe	31

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2580	Buildd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2580	Buildd.exe
2580	Buildd.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeDebugPrivilege	2580	Buildd.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 892	2580	Buildd.exe	28
PID 2580 wrote to memory of 892	2580	Buildd.exe	28
PID 2580 wrote to memory of 892	2580	Buildd.exe	28
PID 2580 wrote to memory of 892	2580	Buildd.exe	28
PID 892 wrote to memory of 2328	892	explorer.exe	29
PID 892 wrote to memory of 2328	892	explorer.exe	29
PID 892 wrote to memory of 2328	892	explorer.exe	29
PID 2580 wrote to memory of 2928	2580	Buildd.exe	30
PID 2580 wrote to memory of 2928	2580	Buildd.exe	30
PID 2580 wrote to memory of 2928	2580	Buildd.exe	30
PID 2580 wrote to memory of 2928	2580	Buildd.exe	30
PID 2580 wrote to memory of 2840	2580	Buildd.exe	31
PID 2580 wrote to memory of 2840	2580	Buildd.exe	31
PID 2580 wrote to memory of 2840	2580	Buildd.exe	31
PID 2580 wrote to memory of 2840	2580	Buildd.exe	31
PID 2580 wrote to memory of 2840	2580	Buildd.exe	31
PID 2580 wrote to memory of 2840	2580	Buildd.exe	31
PID 2580 wrote to memory of 2840	2580	Buildd.exe	31
PID 2580 wrote to memory of 2840	2580	Buildd.exe	31
PID 2580 wrote to memory of 2840	2580	Buildd.exe	31

C:\Users\Admin\AppData\Local\Temp\Buildd.exe
"C:\Users\Admin\AppData\Local\Temp\Buildd.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 185.215.113.39 8082 MVpyBUYqm
  2⤵
  PID:2928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 185.215.113.39 8082 MVpyBUYqm
  2⤵
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-65-0x0000000003B60000-0x0000000003B61000-memory.dmp

Filesize
4KB

Download
memory/892-86-0x0000000002660000-0x0000000002670000-memory.dmp

Filesize
64KB

Download
memory/892-71-0x0000000003B60000-0x0000000003B61000-memory.dmp

Filesize
4KB

Download
memory/2580-56-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-57-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-5-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-6-0x00000000768E0000-0x0000000076927000-memory.dmp

Filesize
284KB

Download
memory/2580-7-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-8-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-9-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-10-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-11-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-12-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-13-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-14-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-16-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-18-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-20-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-22-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-23-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-24-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-25-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-26-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-27-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-28-0x00000000777E0000-0x00000000777E2000-memory.dmp

Filesize
8KB

Download
memory/2580-29-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2580-30-0x0000000000A40000-0x00000000016C0000-memory.dmp

Filesize
12.5MB

Download
memory/2580-31-0x0000000000A40000-0x00000000016C0000-memory.dmp

Filesize
12.5MB

Download
memory/2580-32-0x0000000005B50000-0x0000000005B90000-memory.dmp

Filesize
256KB

Download
memory/2580-1-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-2-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-67-0x0000000005B50000-0x0000000005B90000-memory.dmp

Filesize
256KB

Download
memory/2580-66-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2580-4-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-3-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-64-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-58-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-62-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-63-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-46-0x0000000000A40000-0x00000000016C0000-memory.dmp

Filesize
12.5MB

Download
memory/2580-47-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-49-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-50-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-52-0x00000000768E0000-0x0000000076927000-memory.dmp

Filesize
284KB

Download
memory/2580-51-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-53-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-54-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-55-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-0-0x0000000000A40000-0x00000000016C0000-memory.dmp

Filesize
12.5MB

Download
memory/2580-61-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-59-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2580-60-0x0000000075510000-0x0000000075620000-memory.dmp

Filesize
1.1MB

Download
memory/2840-34-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2840-33-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2840-44-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-43-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2840-39-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2840-45-0x0000000004B60000-0x0000000004BA0000-memory.dmp

Filesize
256KB

Download
memory/2840-41-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2840-35-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2840-68-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-69-0x0000000004B60000-0x0000000004BA0000-memory.dmp

Filesize
256KB

Download
memory/2840-36-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2840-37-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download