Overview

overview

10

Static

static

10

sss/Install/Del3.bat

windows7-x64

1

sss/Install/Del3.bat

windows10-2004-x64

1

sss/Instal...te.bat

windows7-x64

1

sss/Instal...te.bat

windows10-2004-x64

1

sss/Install/del.bat

windows7-x64

1

sss/Install/del.bat

windows10-2004-x64

1

sss/Install/smss.exe

windows7-x64

10

sss/Install/smss.exe

windows10-2004-x64

10

sss/RDPWinst.exe

windows7-x64

1

sss/RDPWinst.exe

windows10-2004-x64

1

sss/ReaIte...st.exe

windows7-x64

10

sss/ReaIte...st.exe

windows10-2004-x64

10

sss/ReaIte...tw.exe

windows7-x64

9

sss/ReaIte...tw.exe

windows10-2004-x64

9

sss/Window...rv.exe

windows7-x64

10

sss/Window...rv.exe

windows10-2004-x64

10

sss/Window...MD.exe

windows7-x64

1

sss/Window...MD.exe

windows10-2004-x64

1

sss/Window...le.exe

windows7-x64

1

sss/Window...le.exe

windows10-2004-x64

1

sss/Window...st.exe

windows7-x64

1

sss/Window...st.exe

windows10-2004-x64

1

sss/Window...64.sys

windows7-x64

1

sss/Window...64.sys

windows10-2004-x64

1

sss/Window...dg.exe

windows7-x64

9

sss/Window...dg.exe

windows10-2004-x64

9

sss/Window...on.bat

windows7-x64

1

sss/Window...on.bat

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-03-2024 23:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sss/ReaItekHD/taskhostw.exe

  • Size

    28.1MB

  • MD5

    dc1292c7fa973a334934340d6674e376

  • SHA1

    82660001eeefec20cdfa4ce78f8db5e6968ce729

  • SHA256

    fcc78017b47e6d12fc84a479bce14e27562e746d928ebe30bdb13cbc3cc8c2d1

  • SHA512

    7fe20bc6ccd8e78036c5ab7517706f88e8d5ed4ed602515ad702d4db5a2271b44fd76fed5fd7bbf4cd47b5006cfb97772f01f6ead2b35af7ff10d7b9ec2c4a04

  • SSDEEP

    786432:5Uv4WjB487BSaxifeu5K/P9D/puKTLAA+ecrJ:5UvbnoX5g/puKTczr

Score
9/10
evasionpersistencethemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 24 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 22 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sss\ReaItekHD\taskhostw.exe
    "C:\Users\Admin\AppData\Local\Temp\sss\ReaItekHD\taskhostw.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Drops file in Drivers directory
    • Checks BIOS information in registry
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:3572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Setup\bip39.txt
    Filesize

    14KB

    MD5

    51ca2264f5b3ad532a4d6dae175e1750

    SHA1

    3dc996beb38928c70fca66658c46b00092ae6532

    SHA256

    d2bd2aeb50ac5df60c1eb10afcec2b680d5a8a9f2bbc74a15c45bf3525528334

    SHA512

    6c169854acd97daf85ebfbefb78ae9b1ce249e8c6a79c7eaa42bcf6c546e6e14bae25bbe989b2e2d07d9ba92a69908b320534b0b97e5ba305bd783273e8d1e55

    Download Submit

  • memory/3572-23-0x0000015C55320000-0x0000015C55321000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3572-3-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-28-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-4-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-5-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-6-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-7-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-8-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-9-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-1-0x00007FF9A5ED0000-0x00007FF9A60C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3572-26-0x0000015C553B0000-0x0000015C553B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3572-25-0x0000015C55330000-0x0000015C55331000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3572-24-0x0000015C553A0000-0x0000015C553A1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3572-0-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-42-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-2-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-29-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-30-0x00007FF9A5ED0000-0x00007FF9A60C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3572-31-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-32-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-33-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-34-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-35-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-36-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-37-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-38-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-39-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-40-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-41-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download

  • memory/3572-27-0x00007FF6040E0000-0x00007FF60655E000-memory.dmp

    Filesize

    36.5MB

    Download