cc85ea1f8a41f30717c21c6210140636581829ecac1065b44fb41cda19433342 | Triage

Sharing

General

Target

LoaderKernel.dll
Size

19.8MB
Sample

240203-n19pqaaggr
MD5

c2041e2d61ef8fe7627c5e929e04264a
SHA1

950a1cc826d8a5ed05e03425e2cd5a2c646caace
SHA256

cc85ea1f8a41f30717c21c6210140636581829ecac1065b44fb41cda19433342
SHA512

5e22900f51d681dcb97710157dbd09154dbd6b73b46319ae137919761c494bc3d5c327cdc8a183df151ddfa7cc2d914f198f26d4ca7581dbd7f011ca94b5deab
SSDEEP

393216:DRY7e1+rHO/ts/VXVUx3xrmu8ClMPKXef7PQ:FjCFVXyhCYmyi0

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  LoaderKernel.dll
- Size
  
  19.8MB
- MD5
  
  c2041e2d61ef8fe7627c5e929e04264a
- SHA1
  
  950a1cc826d8a5ed05e03425e2cd5a2c646caace
- SHA256
  
  cc85ea1f8a41f30717c21c6210140636581829ecac1065b44fb41cda19433342
- SHA512
  
  5e22900f51d681dcb97710157dbd09154dbd6b73b46319ae137919761c494bc3d5c327cdc8a183df151ddfa7cc2d914f198f26d4ca7581dbd7f011ca94b5deab
- SSDEEP
  
  393216:DRY7e1+rHO/ts/VXVUx3xrmu8ClMPKXef7PQ:FjCFVXyhCYmyi0
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2