Overview

overview

9

Static

static

7

Render.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Render.exe

  • Size

    7.9MB

  • Sample

    240309-ryvdssaa42

  • MD5

    6fb0f4100edb81e9db8581c4424be171

  • SHA1

    12555aad36e75f3caedea6b2b834154a0a95c880

  • SHA256

    55ef52db75cd48a2fcd03fff69e7e8a31ebf26d4ef170d0c9e68765624278116

  • SHA512

    dafd9bdb3b0c031645e6f7e6f684a6d4baf4a4a62efb3ff2c4537699cee188d25b46f917a247dc1e42b337574e32ddb675ce33ff41a373b995ec362b1607fda3

  • SSDEEP

    196608:Saz4mfp7n4GEiVuEwujjhg3i1UHJt5VrJmYTz/:SaE8n4+V6u3O39H73ggz

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      Render.exe

    • Size

      7.9MB

    • MD5

      6fb0f4100edb81e9db8581c4424be171

    • SHA1

      12555aad36e75f3caedea6b2b834154a0a95c880

    • SHA256

      55ef52db75cd48a2fcd03fff69e7e8a31ebf26d4ef170d0c9e68765624278116

    • SHA512

      dafd9bdb3b0c031645e6f7e6f684a6d4baf4a4a62efb3ff2c4537699cee188d25b46f917a247dc1e42b337574e32ddb675ce33ff41a373b995ec362b1607fda3

    • SSDEEP

      196608:Saz4mfp7n4GEiVuEwujjhg3i1UHJt5VrJmYTz/:SaE8n4+V6u3O39H73ggz

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks