0b06f84f2776bf4e4c28e73625defe855d3817b1de1a17183db39016f7109695

Analysis

max time kernel
141s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

inst.exe
Size

5.3MB
MD5

2ec92d9ae90fa8d467434d4950046233
SHA1

a1201629f91ce9d57539e1574548222f3aca9b17
SHA256

0b06f84f2776bf4e4c28e73625defe855d3817b1de1a17183db39016f7109695
SHA512

2b1b0284ab697aa0da00b670cdff68beeb48d9fe9b39dea21562ccff29eba958e3ce08ee7c07cdfa0b82f2cf42fe43f4c4ba75d62eb2215023354cb1a70553f9
SSDEEP

98304:vNN/N91h2eDZQjL7sU8I5DKBWoClkRGJewd8Y3evBQ9LtYVrEx3/o6ETgKbWyuk:B9GeDVI5DKBWZlkgJedYs6LtYdEhqTgY

Score

9^/10

agilenet evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

inst.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ inst.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	inst.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

inst.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	inst.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	inst.exe

Loads dropped DLL 1 IoCs

Processes:

inst.exe

pid process

2300 inst.exe

pid	process
2300	inst.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/2300-0-0x0000000000100000-0x000000000064A000-memory.dmp	agile_net

Themida packer 17 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\c3151015-52f5-4d47-88a4-ea55aea0d52a\AgileDotNetRT64.dll	themida
behavioral1/memory/2300-9-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-11-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-40-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-51-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-52-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-53-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-54-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-55-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-56-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-57-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-58-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-59-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-60-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-61-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-62-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida
behavioral1/memory/2300-63-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

inst.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA inst.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exeinst.exe

pid process

2720 powershell.exe
2808 powershell.exe
2300 inst.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	inst.exe

pid	process
2720	powershell.exe
2808	powershell.exe
2300	inst.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

inst.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2300	inst.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2300	inst.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

inst.exe

pid process

2300 inst.exe

pid	process
2300	inst.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

inst.exe

description	pid	process	target process
PID 2300 wrote to memory of 2720	2300	inst.exe	powershell.exe
PID 2300 wrote to memory of 2720	2300	inst.exe	powershell.exe
PID 2300 wrote to memory of 2720	2300	inst.exe	powershell.exe
PID 2300 wrote to memory of 2808	2300	inst.exe	powershell.exe
PID 2300 wrote to memory of 2808	2300	inst.exe	powershell.exe
PID 2300 wrote to memory of 2808	2300	inst.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\inst.exe
"C:\Users\Admin\AppData\Local\Temp\inst.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\inst.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'inst.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
8a9b3f289fd66999e84fd3efe3206e17

SHA1
68a2dc78ebeedd8b7eabdaa3e02a7a15e497c861

SHA256
a3e49bbf29520bb414c07f8c460913fdfefa967d7a1e4a252d7436477172a403

SHA512
5b173d2c349536fda8034cabe513b892690832ce57652bd7a9757097b11583402db18101d251d51fde7db5d54538aaaef991df19741a1e1c44ab4c63ace38207

Download Submit
\Users\Admin\AppData\Local\Temp\c3151015-52f5-4d47-88a4-ea55aea0d52a\AgileDotNetRT64.dll

Filesize
2.9MB

MD5
9bb6ed08af544d3738e60200d2804180

SHA1
5a40b484ca56b1ce59add4ec283e21d60070be02

SHA256
86d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7

SHA512
63e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5

Download Submit
memory/2300-0-0x0000000000100000-0x000000000064A000-memory.dmp

Filesize
5.3MB

Download
memory/2300-58-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-9-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-11-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-21-0x000007FEF3F20000-0x000007FEF404C000-memory.dmp

Filesize
1.2MB

Download
memory/2300-63-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-62-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-61-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-48-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2300-60-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-59-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-2-0x000000001B550000-0x000000001B5D0000-memory.dmp

Filesize
512KB

Download
memory/2300-57-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-56-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-1-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2300-40-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-55-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-54-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-53-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-52-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2300-51-0x000007FEF1B60000-0x000007FEF2312000-memory.dmp

Filesize
7.7MB

Download
memory/2720-29-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2720-34-0x000007FEEEE60000-0x000007FEEF7FD000-memory.dmp

Filesize
9.6MB

Download
memory/2720-26-0x000000001B230000-0x000000001B512000-memory.dmp

Filesize
2.9MB

Download
memory/2720-28-0x000007FEEEE60000-0x000007FEEF7FD000-memory.dmp

Filesize
9.6MB

Download
memory/2720-27-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/2720-30-0x000007FEEEE60000-0x000007FEEF7FD000-memory.dmp

Filesize
9.6MB

Download
memory/2720-31-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2720-32-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2720-33-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2808-47-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/2808-44-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/2808-43-0x000007FEED300000-0x000007FEEDC9D000-memory.dmp

Filesize
9.6MB

Download
memory/2808-42-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Filesize
32KB

Download
memory/2808-41-0x000000001B280000-0x000000001B562000-memory.dmp

Filesize
2.9MB

Download
memory/2808-46-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/2808-50-0x000007FEED300000-0x000007FEEDC9D000-memory.dmp

Filesize
9.6MB

Download
memory/2808-45-0x000007FEED300000-0x000007FEEDC9D000-memory.dmp

Filesize
9.6MB

Download
memory/2808-49-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download