Overview

overview

9

Static

static

3

Loader.exe

windows7-x64

9

Loader.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    Loader.exe

  • Size

    667.6MB

  • Sample

    240427-drkn5aaf71

  • MD5

    7cc20058012097efa4abde90287e38f4

  • SHA1

    82f54527ff8cd2695dc391f39978dee0192b3080

  • SHA256

    18aca5c964d48dc9d8cdcd4a4a7a4be5fba19f72c5aa94d2090e84dbad4ea38b

  • SHA512

    c208d3e6fc5a0fb3b10cc8ebd69976bda8e3b2cb49debd425b1b19e49afd78795772c1c085dbd8f2e5836340bcf9ee2ef941d99e114bec7726062178a6dcd856

  • SSDEEP

    196608:kpHkUgQgnjoklXR4R4rwEH5OTSFG+OIvcW/rBXBFIoioPPPEdAL6M6:kpHkUAckl6qPHcSBXBFOAUdk6P

Score
9/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      Loader.exe

    • Size

      667.6MB

    • MD5

      7cc20058012097efa4abde90287e38f4

    • SHA1

      82f54527ff8cd2695dc391f39978dee0192b3080

    • SHA256

      18aca5c964d48dc9d8cdcd4a4a7a4be5fba19f72c5aa94d2090e84dbad4ea38b

    • SHA512

      c208d3e6fc5a0fb3b10cc8ebd69976bda8e3b2cb49debd425b1b19e49afd78795772c1c085dbd8f2e5836340bcf9ee2ef941d99e114bec7726062178a6dcd856

    • SSDEEP

      196608:kpHkUgQgnjoklXR4R4rwEH5OTSFG+OIvcW/rBXBFIoioPPPEdAL6M6:kpHkUAckl6qPHcSBXBFOAUdk6P

    Score
    9/10
    evasionpersistencethemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Creates new service(s)

      persistence

    • Sets service image path in registry

      persistence

    • Stops running service(s)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks