008d1f88e2ac16aadc7635124282b6c7fd785db4fc0e3ba2c59673a036700cb4

General

Target
008d1f88e2ac16aadc7635124282b6c7fd785db4fc0e3ba2c59673a036700cb4.exe
Size 2.6MB
Sample240412-wp49vsce58
SHA256 008d1f88e2ac16aadc7635124282b6c7fd785db4fc0e3ba2c59673a036700cb4
MD5 c8c1e2de2c49494df2768a49679dc8ba
SHA1 efb3301cd6869e0b97a3a1bde24e9ad10c4dc6be
SHA512 0446aa9ecab863403cdbb1e50fe6e83cee7b3cc33344b14048b44c619ff0b053e496f00a3e42a5c7338c8bdb85977d98f80efcc34a19b066239e743f1dbc0656
SSDEEP 49152:tXT+QuXdpYGTzMMBAEi4/XFb30SBPpmdS+my+zu8Gebor3K+cXKBiTLGA:ctKGhBAETX5kSBPpZy5GI6RKBiWA
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Signatures

Detects executables packed with Themida 3 IoCs

resource	yara_rule
behavioral1/memory/1908-0-0x0000000000400000-0x0000000000AB2000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral1/files/0x00040000000130fc-5.dat	INDICATOR_EXE_Packed_Themida
behavioral1/memory/3020-7-0x0000000000400000-0x0000000000AB2000-memory.dmp	INDICATOR_EXE_Packed_Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	008d1f88e2ac16aadc7635124282b6c7fd785db4fc0e3ba2c59673a036700cb4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nhadrjb.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	008d1f88e2ac16aadc7635124282b6c7fd785db4fc0e3ba2c59673a036700cb4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	008d1f88e2ac16aadc7635124282b6c7fd785db4fc0e3ba2c59673a036700cb4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nhadrjb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nhadrjb.exe

Executes dropped EXE 1 IoCs

pid	Process
3020	nhadrjb.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1908-0-0x0000000000400000-0x0000000000AB2000-memory.dmp	themida
behavioral1/files/0x00040000000130fc-5.dat	themida
behavioral1/memory/3020-7-0x0000000000400000-0x0000000000AB2000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	008d1f88e2ac16aadc7635124282b6c7fd785db4fc0e3ba2c59673a036700cb4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nhadrjb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\mrcfdgn.dll	nhadrjb.exe
File created	C:\PROGRA~3\Mozilla\nhadrjb.exe	008d1f88e2ac16aadc7635124282b6c7fd785db4fc0e3ba2c59673a036700cb4.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1908	008d1f88e2ac16aadc7635124282b6c7fd785db4fc0e3ba2c59673a036700cb4.exe
3020	nhadrjb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3020	2000	taskeng.exe	29
PID 2000 wrote to memory of 3020	2000	taskeng.exe	29
PID 2000 wrote to memory of 3020	2000	taskeng.exe	29
PID 2000 wrote to memory of 3020	2000	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\008d1f88e2ac16aadc7635124282b6c7fd785db4fc0e3ba2c59673a036700cb4.exe
"C:\Users\Admin\AppData\Local\Temp\008d1f88e2ac16aadc7635124282b6c7fd785db4fc0e3ba2c59673a036700cb4.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:1908

C:\Windows\system32\taskeng.exe
taskeng.exe {F75B074D-B03C-43A7-B17C-E56A4FDD08F4} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\PROGRA~3\Mozilla\nhadrjb.exe
  C:\PROGRA~3\Mozilla\nhadrjb.exe -giukxrm
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nhadrjb.exe

Path C:\PROGRA~3\Mozilla\nhadrjb.exe
Size 2.6MB
SHA256 37f7829fea15f3b3d99cf1491ee274fdc0b559e539f53bbf5369bca210e75499
MD5 77d8d97e25d59f7f53476adccd7fdb96
SHA1 5131e25be176cc3ae76af84557bfaae08e414a09
SHA512 0fb4ffd7dd7285d3aaf28f760fb522548b11ce4774741c25974011929561897f6ae800ab14fd71e66c63f0e63a02cada777d1d4e920e25ad1984072df046f406
SSDEEP 49152:tXT+QuXdpYGTzMMBAEi4/XFb30SBPpmdS+my+zu8Gebor3K+cXKBiTLGE:ctKGhBAETX5kSBPpZy5GI6RKBiWE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1908-0-0x0000000000400000-0x0000000000AB2000-memory.dmp

Download

memory/1908-2-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1908-1-0x00000000002F0000-0x000000000034B000-memory.dmp

Download

memory/1908-4-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3020-7-0x0000000000400000-0x0000000000AB2000-memory.dmp

Download

memory/3020-8-0x0000000000BF0000-0x0000000000C4B000-memory.dmp

Download

memory/3020-9-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3020-11-0x0000000000400000-0x000000000045B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads