c8f7cef323792b6b8bf74024704ad6add92b48d81c853b6cf41456bcc3519b10

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 15:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8f7cef323792b6b8bf74024704ad6add92b48d81c853b6cf41456bcc3519b10.exe
Size

3.3MB
MD5

a3619854525630026f2df50838380682
SHA1

2010067183d7f92c1026d72f6473b85a2e5dc739
SHA256

c8f7cef323792b6b8bf74024704ad6add92b48d81c853b6cf41456bcc3519b10
SHA512

c20603c5cd8775a26706f721b6c73a2b21f0da73e97c2aa1215b3a2f5c975b7ed100012e153810491969074037e40055b89bd90d9908445a7b075a5fa3bc1d49
SSDEEP

49152:wDBZSX8RHo1Za95CIyVVjQdHl/Mlj1tBTbZ6zmIgDA3qIx/UZ7jUul8OFDWjrxrZ:wiHFVEHOfba3qY/U1jhl8A2NhEUrMK

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c8f7cef323792b6b8bf74024704ad6add92b48d81c853b6cf41456bcc3519b10.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c8f7cef323792b6b8bf74024704ad6add92b48d81c853b6cf41456bcc3519b10.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c8f7cef323792b6b8bf74024704ad6add92b48d81c853b6cf41456bcc3519b10.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/2092-13-0x0000000000F90000-0x00000000017C0000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c8f7cef323792b6b8bf74024704ad6add92b48d81c853b6cf41456bcc3519b10.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2092	c8f7cef323792b6b8bf74024704ad6add92b48d81c853b6cf41456bcc3519b10.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2092	c8f7cef323792b6b8bf74024704ad6add92b48d81c853b6cf41456bcc3519b10.exe
2092	c8f7cef323792b6b8bf74024704ad6add92b48d81c853b6cf41456bcc3519b10.exe

C:\Users\Admin\AppData\Local\Temp\c8f7cef323792b6b8bf74024704ad6add92b48d81c853b6cf41456bcc3519b10.exe
"C:\Users\Admin\AppData\Local\Temp\c8f7cef323792b6b8bf74024704ad6add92b48d81c853b6cf41456bcc3519b10.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-0-0x0000000000F90000-0x00000000017C0000-memory.dmp

Filesize
8.2MB

Download
memory/2092-1-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-2-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-3-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-4-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-5-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-6-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-7-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-9-0x0000000077D14000-0x0000000077D16000-memory.dmp

Filesize
8KB

Download
memory/2092-8-0x0000000000F90000-0x00000000017C0000-memory.dmp

Filesize
8.2MB

Download
memory/2092-13-0x0000000000F90000-0x00000000017C0000-memory.dmp

Filesize
8.2MB

Download
memory/2092-14-0x0000000006730000-0x0000000006CD4000-memory.dmp

Filesize
5.6MB

Download
memory/2092-15-0x0000000006180000-0x0000000006212000-memory.dmp

Filesize
584KB

Download
memory/2092-16-0x0000000006310000-0x000000000631A000-memory.dmp

Filesize
40KB

Download
memory/2092-17-0x0000000007300000-0x0000000007918000-memory.dmp

Filesize
6.1MB

Download
memory/2092-18-0x0000000006600000-0x000000000670A000-memory.dmp

Filesize
1.0MB

Download
memory/2092-19-0x0000000006530000-0x0000000006542000-memory.dmp

Filesize
72KB

Download
memory/2092-20-0x0000000006590000-0x00000000065CC000-memory.dmp

Filesize
240KB

Download
memory/2092-21-0x0000000006CE0000-0x0000000006D2C000-memory.dmp

Filesize
304KB

Download
memory/2092-23-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-24-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-25-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-27-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-28-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-29-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download
memory/2092-30-0x0000000076120000-0x0000000076210000-memory.dmp

Filesize
960KB

Download