Overview

overview

9

Static

static

7

YfXFl26W9E.exe

windows7-x64

9

YfXFl26W9E.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    146s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2023, 14:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    YfXFl26W9E.exe

  • Size

    13.5MB

  • MD5

    005c51949d76adb2f624acde2031f68b

  • SHA1

    a560c9ceb511f27906ab65c95b4c5d7088843f9b

  • SHA256

    70aae1a638ff14688e808998909cd036783f80cb75bffe12f1b07aa3fd932aff

  • SHA512

    f7f22b7c6d237f53cbe81fb89adb82ed66eb26d0996c52dbae94e8cff22415a7ce2e26983c050dc4b6205e570326df8f44c0532232c250b143e2dcfaaa1f3f2c

  • SSDEEP

    393216:CfhiAOxOvrq52XXWRct7VdHBpVBQsrQyWudmso:CROEvTl7VdhpVBQGQyW8o

Score
9/10
evasionthemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 10 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\YfXFl26W9E.exe
    "C:\Users\Admin\AppData\Local\Temp\YfXFl26W9E.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3632
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Start_TrackProgs" /t REG_DWORD /d 0 /f >nul 2>&1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4916
      • C:\Windows\system32\reg.exe
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Start_TrackProgs" /t REG_DWORD /d 0 /f
        3⤵
        • Modifies registry key
        PID:3424
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Start_TrackEnabled" /t REG_DWORD /d 0 /f >nul 2>&1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1080
      • C:\Windows\system32\reg.exe
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Start_TrackEnabled" /t REG_DWORD /d 0 /f
        3⤵
        • Modifies registry key
        PID:3372

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3632-0-0x00007FF66DD20000-0x00007FF66FB3C000-memory.dmp

          Filesize

          30.1MB

          Download

        • memory/3632-2-0x00007FF8D5ED0000-0x00007FF8D60C5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/3632-1-0x00007FF66DD20000-0x00007FF66FB3C000-memory.dmp

          Filesize

          30.1MB

          Download

        • memory/3632-3-0x00007FF66DD20000-0x00007FF66FB3C000-memory.dmp

          Filesize

          30.1MB

          Download

        • memory/3632-4-0x00007FF66DD20000-0x00007FF66FB3C000-memory.dmp

          Filesize

          30.1MB

          Download

        • memory/3632-5-0x00007FF66DD20000-0x00007FF66FB3C000-memory.dmp

          Filesize

          30.1MB

          Download

        • memory/3632-6-0x00007FF66DD20000-0x00007FF66FB3C000-memory.dmp

          Filesize

          30.1MB

          Download

        • memory/3632-7-0x00007FF66DD20000-0x00007FF66FB3C000-memory.dmp

          Filesize

          30.1MB

          Download

        • memory/3632-8-0x00007FF66DD20000-0x00007FF66FB3C000-memory.dmp

          Filesize

          30.1MB

          Download

        • memory/3632-9-0x00007FF66DD20000-0x00007FF66FB3C000-memory.dmp

          Filesize

          30.1MB

          Download

        • memory/3632-10-0x00007FF66DD20000-0x00007FF66FB3C000-memory.dmp

          Filesize

          30.1MB

          Download

        • memory/3632-11-0x00007FF8D5ED0000-0x00007FF8D60C5000-memory.dmp

          Filesize

          2.0MB

          Download