2d0e4d3a259a50ed3f7d1ea67be6ddf426f5b7dcacd5f494d00b78321c40d4e4

General

Target

NEAS.4974df26a9e6b84577a351703ae429a0.exe
Size

2.5MB
MD5

4974df26a9e6b84577a351703ae429a0
SHA1

148ad51f9779e67c210a8090f9ea6002366bd9fe
SHA256

2d0e4d3a259a50ed3f7d1ea67be6ddf426f5b7dcacd5f494d00b78321c40d4e4
SHA512

5e80e158af8850e575f9ca077f4538478fce0a8d1c5d746fb4e58d5ce37fecd6d79f0c97c83812c2b9ee763ac7c69291bf6c349104cb678d8b605bb6aa57d1b2
SSDEEP

49152:y4daOqAehx7x20RKuniOJqfU7F1tLYoNovTE3pzNx0FOnpe4v/68M:cP7tRtrJq88SqgnpXiH

Score

9^/10

evasion persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	NEAS.4974df26a9e6b84577a351703ae429a0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axfniqh.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NEAS.4974df26a9e6b84577a351703ae429a0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NEAS.4974df26a9e6b84577a351703ae429a0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axfniqh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axfniqh.exe

Executes dropped EXE 1 IoCs

pid	Process
2260	axfniqh.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/5108-0-0x0000000000400000-0x0000000000A57000-memory.dmp	themida
behavioral2/memory/5108-1-0x0000000000400000-0x0000000000A57000-memory.dmp	themida
behavioral2/memory/5108-2-0x0000000000400000-0x0000000000A57000-memory.dmp	themida
behavioral2/files/0x000b000000022ccb-9.dat	themida
behavioral2/files/0x000b000000022ccb-10.dat	themida
behavioral2/memory/2260-11-0x0000000000400000-0x0000000000A57000-memory.dmp	themida
behavioral2/memory/2260-12-0x0000000000400000-0x0000000000A57000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NEAS.4974df26a9e6b84577a351703ae429a0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	axfniqh.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\axfniqh.exe	NEAS.4974df26a9e6b84577a351703ae429a0.exe
File created	C:\PROGRA~3\Mozilla\bqqaoam.dll	axfniqh.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.4974df26a9e6b84577a351703ae429a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4974df26a9e6b84577a351703ae429a0.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:5108

C:\PROGRA~3\Mozilla\axfniqh.exe
C:\PROGRA~3\Mozilla\axfniqh.exe -pdtylqd
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\axfniqh.exe

Filesize
2.5MB

MD5
ead2f2f96bb20311aa644cb96cef85f7

SHA1
8e61fb402c6730b93b860c12aee171df470f9d42

SHA256
f04b9e158a3203f57cf20761d289c285815d63fbf303382bc0a88e3a060c0f0a

SHA512
876e0be828fae988253b08b19a5a540153c9c9444867fdb5e3dafa7d0e37ac650515396a08229f036cd196cc542cf75aeefda2a18575d6a9c2f61154334d7162

Download Submit
C:\ProgramData\Mozilla\axfniqh.exe

Filesize
2.5MB

MD5
ead2f2f96bb20311aa644cb96cef85f7

SHA1
8e61fb402c6730b93b860c12aee171df470f9d42

SHA256
f04b9e158a3203f57cf20761d289c285815d63fbf303382bc0a88e3a060c0f0a

SHA512
876e0be828fae988253b08b19a5a540153c9c9444867fdb5e3dafa7d0e37ac650515396a08229f036cd196cc542cf75aeefda2a18575d6a9c2f61154334d7162

Download Submit
memory/2260-11-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download
memory/2260-23-0x0000000001810000-0x000000000186C000-memory.dmp

Filesize
368KB

Download
memory/2260-22-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2260-19-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download
memory/2260-18-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2260-17-0x0000000001810000-0x000000000186C000-memory.dmp

Filesize
368KB

Download
memory/2260-12-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download
memory/5108-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5108-8-0x0000000002CC0000-0x0000000002D1C000-memory.dmp

Filesize
368KB

Download
memory/5108-13-0x0000000000690000-0x0000000000A14000-memory.dmp

Filesize
3.5MB

Download
memory/5108-15-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5108-16-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5108-5-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download
memory/5108-0-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download
memory/5108-3-0x0000000002CC0000-0x0000000002D1C000-memory.dmp

Filesize
368KB

Download
memory/5108-2-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download
memory/5108-1-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads