2e24bbb3773c2d0fab2156685298b7c4adf96c22790beab3be80226995954b51

General

Target

NEAS.098aeeead8bcc2fc053a4a7af5db4190.exe
Size

2.5MB
MD5

098aeeead8bcc2fc053a4a7af5db4190
SHA1

717d879bd4178c857c94c34f2f517193ca8460f6
SHA256

2e24bbb3773c2d0fab2156685298b7c4adf96c22790beab3be80226995954b51
SHA512

c2301e55402b6107a70018b07d398c599b86279faec0a8f484efc76162317b935e653ae3d8173e050e321ea9226e06cf426d58cfe3e124719c1e61677599d0d1
SSDEEP

49152:y4daOqAehx7x20RKuniOJqfU7F1tLYoNovTE3pzNx0FOnpe4v/681:cP7tRtrJq88SqgnpXiu

Score

9^/10

evasion persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	NEAS.098aeeead8bcc2fc053a4a7af5db4190.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ecxnjia.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ecxnjia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ecxnjia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NEAS.098aeeead8bcc2fc053a4a7af5db4190.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NEAS.098aeeead8bcc2fc053a4a7af5db4190.exe

Executes dropped EXE 1 IoCs

pid	Process
932	ecxnjia.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4872-0-0x0000000000400000-0x0000000000A57000-memory.dmp	themida
behavioral2/memory/4872-1-0x0000000000400000-0x0000000000A57000-memory.dmp	themida
behavioral2/memory/4872-2-0x0000000000400000-0x0000000000A57000-memory.dmp	themida
behavioral2/files/0x0006000000022df6-9.dat	themida
behavioral2/files/0x0006000000022df6-10.dat	themida
behavioral2/memory/932-14-0x0000000000400000-0x0000000000A57000-memory.dmp	themida
behavioral2/memory/932-15-0x0000000000400000-0x0000000000A57000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NEAS.098aeeead8bcc2fc053a4a7af5db4190.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ecxnjia.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\qxogatk.dll	ecxnjia.exe
File created	C:\PROGRA~3\Mozilla\ecxnjia.exe	NEAS.098aeeead8bcc2fc053a4a7af5db4190.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.098aeeead8bcc2fc053a4a7af5db4190.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.098aeeead8bcc2fc053a4a7af5db4190.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:4872

C:\PROGRA~3\Mozilla\ecxnjia.exe
C:\PROGRA~3\Mozilla\ecxnjia.exe -goglxbn
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\ecxnjia.exe

Filesize
2.5MB

MD5
329534b066b3cce97c1a7722eb1b4b4d

SHA1
d596c59206f737ceae75b70b2824478b24a84e84

SHA256
80dcd2823c94ffe1f91ff70d2b30ac8c57053f7f5f62775ce37784a816527341

SHA512
67939352aa6c6640bd8b83ea77352f1b22e53e2e493dc9bed20c8aae0786e83acabf1c9c2ff4fcb48ec71d5b78917121fef93ebb25c691c21802847bc11fd620

Download Submit
C:\ProgramData\Mozilla\ecxnjia.exe

Filesize
2.5MB

MD5
329534b066b3cce97c1a7722eb1b4b4d

SHA1
d596c59206f737ceae75b70b2824478b24a84e84

SHA256
80dcd2823c94ffe1f91ff70d2b30ac8c57053f7f5f62775ce37784a816527341

SHA512
67939352aa6c6640bd8b83ea77352f1b22e53e2e493dc9bed20c8aae0786e83acabf1c9c2ff4fcb48ec71d5b78917121fef93ebb25c691c21802847bc11fd620

Download Submit
memory/932-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/932-17-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/932-16-0x0000000001830000-0x000000000188C000-memory.dmp

Filesize
368KB

Download
memory/932-15-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download
memory/932-14-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download
memory/4872-3-0x0000000002840000-0x000000000289C000-memory.dmp

Filesize
368KB

Download
memory/4872-12-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4872-13-0x0000000002840000-0x000000000289C000-memory.dmp

Filesize
368KB

Download
memory/4872-8-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download
memory/4872-5-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4872-0-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download
memory/4872-2-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download
memory/4872-1-0x0000000000400000-0x0000000000A57000-memory.dmp

Filesize
6.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads