Overview

overview

10

Static

static

7

loader.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    loader.exe

  • Size

    14MB

  • Sample

    230922-krbjsagh38

  • MD5

    1fbae76f0b442d1eda16ae0895140340

  • SHA1

    c49e14382bb36c985a0a9a6c87e56e7e1e56f8bb

  • SHA256

    8179f809b149d7bb95e3f42fb13a8eb752608cbaef80256f205f4ca497c505f2

  • SHA512

    076f1654b9c8c1133ff6eec6e8a737bb106560bd1852d7be23cb5a30e9361c6da545933e3f158762d1134a563948ff3aab88b2029a0163e330ce8c5db244d120

  • SSDEEP

    196608:7mSkg6Y9zkXYlxVG24boXm2MfhlsNvNp+9glr6KYpVz4qDwZD9VfIjEjv+wwGk2x:7N6Y9ZDyboXmD45Np+L8jZ5VQj0odQ

Score
10/10
evasionransomwarethemidatrojan

Malware Config

Targets

    • Target

      loader.exe

    • Size

      14MB

    • MD5

      1fbae76f0b442d1eda16ae0895140340

    • SHA1

      c49e14382bb36c985a0a9a6c87e56e7e1e56f8bb

    • SHA256

      8179f809b149d7bb95e3f42fb13a8eb752608cbaef80256f205f4ca497c505f2

    • SHA512

      076f1654b9c8c1133ff6eec6e8a737bb106560bd1852d7be23cb5a30e9361c6da545933e3f158762d1134a563948ff3aab88b2029a0163e330ce8c5db244d120

    • SSDEEP

      196608:7mSkg6Y9zkXYlxVG24boXm2MfhlsNvNp+9glr6KYpVz4qDwZD9VfIjEjv+wwGk2x:7N6Y9ZDyboXmD45Np+L8jZ5VQj0odQ

    Score
    10/10
    evasionransomwarethemidatrojan

    • Deletes NTFS Change Journal

      The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

      ransomware

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Stops running service(s)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Impair Defenses

1
T1562

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1
T1490

Data Destruction

1
T1485

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks