43cf51ea2ac2ea60017c077d196d9719c6217548510619aa8ac18c6657163c55

General

Target

main.exe
Size

5.9MB
MD5

3354496085a148bf84e4b9249d8ab9b2
SHA1

7f5a53faa73edac8a2999bc8624b8c8ce943f06a
SHA256

43cf51ea2ac2ea60017c077d196d9719c6217548510619aa8ac18c6657163c55
SHA512

66c9f316002593745d1b7e141c5c0cc70695f50f140ac2b9b32753a89ac3c482a3ca57afa825a2bd6c6e72855ac4367eb0ea1b933974fc3592739b63a93c71df
SSDEEP

98304:TXzhW148Pd+Tf1mpcOldJQ3/V5s18HdDo45ow3ONp2MTJs9wplordZNum6vukIP0:zFK4s0TfLOdo/bs1moU2N8AMmofNum6z

Score

10^/10

evasion persistence pyinstaller themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

main.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	main.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

spoolsv.exesvchost.exespoolsv.exemain.exeexplorer.exeicsys.icn.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	main.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	main.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	icsys.icn.exe

Executes dropped EXE 6 IoCs

Processes:

main.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2212 main.exe
3972 icsys.icn.exe
4808 explorer.exe
1396 spoolsv.exe
3364 svchost.exe
4560 spoolsv.exe

pid	process
2212	main.exe
3972	icsys.icn.exe
4808	explorer.exe
1396	spoolsv.exe
3364	svchost.exe
4560	spoolsv.exe

Themida packer 19 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/3384-0-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
C:\Windows\Resources\Themes\icsys.icn.exe	themida
behavioral2/memory/3972-12-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
C:\Windows\Resources\Themes\explorer.exe	themida
behavioral2/memory/4808-22-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
C:\Windows\Resources\spoolsv.exe	themida
behavioral2/memory/1396-31-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
C:\Windows\Resources\svchost.exe	themida
behavioral2/memory/3364-40-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/4560-45-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/4560-50-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/1396-52-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/3972-54-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/3384-56-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/4808-57-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/3364-58-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/4808-69-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/4808-77-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/4808-81-0x0000000000400000-0x0000000000A16000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

spoolsv.exemain.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	main.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe

Drops file in System32 directory 2 IoCs

Processes:

explorer.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

main.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

3384 main.exe
3972 icsys.icn.exe
4808 explorer.exe
1396 spoolsv.exe
3364 svchost.exe
4560 spoolsv.exe

Drops file in Windows directory 5 IoCs

Processes:

explorer.exemain.exeicsys.icn.exespoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	main.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\main.exe	pyinstaller

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

main.exeicsys.icn.exe

pid	process
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3384	main.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
3972	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

4808 explorer.exe
3364 svchost.exe

pid	process
4808	explorer.exe
3364	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

main.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
3384	main.exe
3384	main.exe
3972	icsys.icn.exe
3972	icsys.icn.exe
4808	explorer.exe
4808	explorer.exe
1396	spoolsv.exe
1396	spoolsv.exe
3364	svchost.exe
3364	svchost.exe
4560	spoolsv.exe
4560	spoolsv.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

main.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 3384 wrote to memory of 2212	3384	main.exe	main.exe
PID 3384 wrote to memory of 2212	3384	main.exe	main.exe
PID 3384 wrote to memory of 3972	3384	main.exe	icsys.icn.exe
PID 3384 wrote to memory of 3972	3384	main.exe	icsys.icn.exe
PID 3384 wrote to memory of 3972	3384	main.exe	icsys.icn.exe
PID 3972 wrote to memory of 4808	3972	icsys.icn.exe	explorer.exe
PID 3972 wrote to memory of 4808	3972	icsys.icn.exe	explorer.exe
PID 3972 wrote to memory of 4808	3972	icsys.icn.exe	explorer.exe
PID 4808 wrote to memory of 1396	4808	explorer.exe	spoolsv.exe
PID 4808 wrote to memory of 1396	4808	explorer.exe	spoolsv.exe
PID 4808 wrote to memory of 1396	4808	explorer.exe	spoolsv.exe
PID 1396 wrote to memory of 3364	1396	spoolsv.exe	svchost.exe
PID 1396 wrote to memory of 3364	1396	spoolsv.exe	svchost.exe
PID 1396 wrote to memory of 3364	1396	spoolsv.exe	svchost.exe
PID 3364 wrote to memory of 4560	3364	svchost.exe	spoolsv.exe
PID 3364 wrote to memory of 4560	3364	svchost.exe	spoolsv.exe
PID 3364 wrote to memory of 4560	3364	svchost.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384

\??\c:\users\admin\appdata\local\temp\main.exe
c:\users\admin\appdata\local\temp\main.exe
2⤵
- Executes dropped EXE
PID:2212

C:\Windows\Resources\Themes\icsys.icn.exe
C:\Windows\Resources\Themes\icsys.icn.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972

\??\c:\windows\resources\themes\explorer.exe
c:\windows\resources\themes\explorer.exe
3⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe SE
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396

\??\c:\windows\resources\svchost.exe
c:\windows\resources\svchost.exe
5⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe PR
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4560

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Modify Registry

2

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\main.exe
Filesize
3.3MB

MD5
e168624c9f4fad11c86c25d583cefb04

SHA1
a556c2fdfad5c51aba45adc409eaf7338d23a428

SHA256
d0047a3ee6b59e8818d228ed777ca9b89d24704a434d27b81684024a413f3fbe

SHA512
4b4b96e7db991280e9bcf882ad5d693d7347343ebdf100f6710e034b7c0f410c6e67b19646b0904571eb0bc852e0137ee4d236af23463c89f1cbc48b419c404d

Download Submit
C:\Windows\Resources\Themes\explorer.exe
Filesize
2.6MB

MD5
56b40d5815b1c6673dc2dd3ada5200eb

SHA1
b304c00046dbc812bd3e071546f4559ae4b71963

SHA256
b4e72fc62a612a6bf816e2e65edc0bbecb15f19310bdd9ad807495ca94571163

SHA512
591f95c7e4b234ec54a72af0c5742dfe23835acac4b3dbf542ae17cd1da35538c73976d1f732485b82937ebe558db985e54e6fe1a21d880d0899bbfd14bda598

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe
Filesize
2.6MB

MD5
8fae25504ebef94f673e3c80794aebf2

SHA1
41c47bbb0df508aa7df176b341de0def27753bb5

SHA256
be5266e372e2a0a51e96f68b0d63399ec215b47424333846fa178dbfcf4c423f

SHA512
62ef06081c7f3bf5e1d197f804976479ce983203eb1001b5d9aaeb342d86b041711ad9075ef88952d37051bd2f3a22a391534543d9dd1340db801bde4b1c7aaa

Download Submit
C:\Windows\Resources\spoolsv.exe
Filesize
2.6MB

MD5
6adeccb29342517f69e9e208d3fe40ba

SHA1
8812209e5d1f843279214fda7d1e6bfeefda29c2

SHA256
e12081185625d6902b7813fe2b3ca94ec8263c6e1a1e9eb62c6c47e915fc19ae

SHA512
196ba6486ec68f62dcf9fe1339cb652fa1c08e7f43b5b39a89d6c0d020b9efc693d84f79c21af03b45a1078383202d095abba65d35a2fcad9068d863ef1c3cf9

Download Submit
C:\Windows\Resources\svchost.exe
Filesize
2.6MB

MD5
cd57d04edf327014fe52ed4290e7de22

SHA1
49cb8f3bdfb760897f56e49e5922453fba7b797f

SHA256
f61af3aeee7ed1ced1fcf7a527ee6078a3a7a9e7544469843e8c7cfe907004e7

SHA512
4c614dbdaf07813989a01cb332457bcbc1f1b3f08ca8d1011802081ecf2b08d620058a4aecf2637fd812d47962cf7d3047586b61886a323edcbae2cbd7cd1dc2

Download Submit
memory/1396-52-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1396-31-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3364-40-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3364-58-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3384-1-0x0000000077D34000-0x0000000077D36000-memory.dmp

Filesize
8KB

Download
memory/3384-0-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3384-56-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3972-54-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3972-12-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/4560-50-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/4560-45-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/4808-22-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/4808-57-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/4808-69-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/4808-77-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/4808-81-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads