2da7ec7e791cdfacc5d24164fe9d74fd2123d4790bf64f3378573be4164c3da3

General

Target

e726fce32bb643902827af8126f05ad9.exe
Size

6.8MB
MD5

e726fce32bb643902827af8126f05ad9
SHA1

56cd4a1e3c542cf4e4f917d06abcc1db58e5ce79
SHA256

2da7ec7e791cdfacc5d24164fe9d74fd2123d4790bf64f3378573be4164c3da3
SHA512

1a110309bf56558a747611cd009e19fa46937047e6dc15528496a53c78ebfeda58cb7eb3f24e188a7f4182000d828b0e6b5e3b5012dfc4f4a2dee96176b65f0a
SSDEEP

196608:+oJ6O3UwxtOB0BGeuMieLesKAGUeR+SdYMfj:1JfnPjGelizsRbeZdZj

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 1624 created 1256	1624	e726fce32bb643902827af8126f05ad9.exe	13
PID 1624 created 1256	1624	e726fce32bb643902827af8126f05ad9.exe	13
PID 1624 created 1256	1624	e726fce32bb643902827af8126f05ad9.exe	13

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e726fce32bb643902827af8126f05ad9.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e726fce32bb643902827af8126f05ad9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e726fce32bb643902827af8126f05ad9.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1624-1-0x000000013FC30000-0x0000000140A0F000-memory.dmp	themida
behavioral1/memory/1624-0-0x000000013FC30000-0x0000000140A0F000-memory.dmp	themida
behavioral1/memory/1624-3-0x000000013FC30000-0x0000000140A0F000-memory.dmp	themida
behavioral1/memory/1624-4-0x000000013FC30000-0x0000000140A0F000-memory.dmp	themida
behavioral1/memory/1624-5-0x000000013FC30000-0x0000000140A0F000-memory.dmp	themida
behavioral1/memory/1624-6-0x000000013FC30000-0x0000000140A0F000-memory.dmp	themida
behavioral1/memory/1624-12-0x000000013FC30000-0x0000000140A0F000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e726fce32bb643902827af8126f05ad9.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1624	e726fce32bb643902827af8126f05ad9.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1624	e726fce32bb643902827af8126f05ad9.exe
1624	e726fce32bb643902827af8126f05ad9.exe
1624	e726fce32bb643902827af8126f05ad9.exe
1624	e726fce32bb643902827af8126f05ad9.exe
1624	e726fce32bb643902827af8126f05ad9.exe
1624	e726fce32bb643902827af8126f05ad9.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256
- C:\Users\Admin\AppData\Local\Temp\e726fce32bb643902827af8126f05ad9.exe
  "C:\Users\Admin\AppData\Local\Temp\e726fce32bb643902827af8126f05ad9.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2668
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\ekuqewhpcyqq.xml"
  2⤵
  - Creates scheduled task(s)
  PID:2736
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ekuqewhpcyqq.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
memory/1624-1-0x000000013FC30000-0x0000000140A0F000-memory.dmp

Filesize
13.9MB

Download
memory/1624-0-0x000000013FC30000-0x0000000140A0F000-memory.dmp

Filesize
13.9MB

Download
memory/1624-2-0x0000000076FD0000-0x0000000077179000-memory.dmp

Filesize
1.7MB

Download
memory/1624-3-0x000000013FC30000-0x0000000140A0F000-memory.dmp

Filesize
13.9MB

Download
memory/1624-4-0x000000013FC30000-0x0000000140A0F000-memory.dmp

Filesize
13.9MB

Download
memory/1624-5-0x000000013FC30000-0x0000000140A0F000-memory.dmp

Filesize
13.9MB

Download
memory/1624-6-0x000000013FC30000-0x0000000140A0F000-memory.dmp

Filesize
13.9MB

Download
memory/1624-8-0x0000000076FD0000-0x0000000077179000-memory.dmp

Filesize
1.7MB

Download
memory/1624-13-0x0000000076FD0000-0x0000000077179000-memory.dmp

Filesize
1.7MB

Download
memory/1624-12-0x000000013FC30000-0x0000000140A0F000-memory.dmp

Filesize
13.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads