bab2cdd95bb34ec1147ec11e33b5f3194b91b0b82358d8e8f517428eb0fc919f

General

Target

Catalyst_InDev0.1_protected.exe
Size

13.8MB
MD5

f21878d3a0fe8c661f336c30c4dae788
SHA1

5229e86c8ea319ce8a2c22fbc8281db747a99a2c
SHA256

bab2cdd95bb34ec1147ec11e33b5f3194b91b0b82358d8e8f517428eb0fc919f
SHA512

2cea72cfa827252e873fbbe6b6506f60aa1926a182602e6cbe79f9a33147daa2598cd0ffa1940a4b7644b65ff05da172d8ffd5ccf585b88948e9e6e91f80e3d1
SSDEEP

393216:vU4ZnmOateOirwCMQnDxOfhbs1l7TAVvwTP:s+se7rwCMQtOfhsOvwTP

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Catalyst_InDev0.1_protected.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Catalyst_InDev0.1_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Catalyst_InDev0.1_protected.exe

Executes dropped EXE 1 IoCs

pid	Process
2660	Catalyst_InDev0.1.exe

Loads dropped DLL 2 IoCs

pid	Process
2696	Catalyst_InDev0.1_protected.exe
2660	Catalyst_InDev0.1.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2696-0-0x000000013F8C0000-0x0000000140C3A000-memory.dmp	themida
behavioral1/memory/2696-2-0x000000013F8C0000-0x0000000140C3A000-memory.dmp	themida
behavioral1/memory/2696-3-0x000000013F8C0000-0x0000000140C3A000-memory.dmp	themida
behavioral1/memory/2696-37-0x000000013F8C0000-0x0000000140C3A000-memory.dmp	themida
behavioral1/memory/2696-64-0x000000013F8C0000-0x0000000140C3A000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Catalyst_InDev0.1_protected.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2696	Catalyst_InDev0.1_protected.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2660	2696	Catalyst_InDev0.1_protected.exe	29
PID 2696 wrote to memory of 2660	2696	Catalyst_InDev0.1_protected.exe	29
PID 2696 wrote to memory of 2660	2696	Catalyst_InDev0.1_protected.exe	29

C:\Users\Admin\AppData\Local\Temp\Catalyst_InDev0.1_protected.exe
"C:\Users\Admin\AppData\Local\Temp\Catalyst_InDev0.1_protected.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\onefile_2696_133588687183128000\Catalyst_InDev0.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Catalyst_InDev0.1_protected.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_2696_133588687183128000\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2696_133588687183128000\Catalyst_InDev0.1.exe

Filesize
18.9MB

MD5
a741156268d6ab6453764be886311f4f

SHA1
3bb0602428b38ffbc87d3862f690a3bbdae8f8ce

SHA256
d4a362825a355126eafd5fba2795722948bb6215456415d9ae9ef05f09c2cb6c

SHA512
48cd06115b888f47c20bbeaed584a2c9f61b12e3cef5f61f3165f3dfa92b580f9992c70608c1224024c3379437366fa54404096ea3ab37cfca79a81bb8fb4a98

Download Submit
memory/2660-36-0x000000013F7F0000-0x0000000140B22000-memory.dmp

Filesize
19.2MB

Download
memory/2696-1-0x0000000077B30000-0x0000000077CD9000-memory.dmp

Filesize
1.7MB

Download
memory/2696-0-0x000000013F8C0000-0x0000000140C3A000-memory.dmp

Filesize
19.5MB

Download
memory/2696-2-0x000000013F8C0000-0x0000000140C3A000-memory.dmp

Filesize
19.5MB

Download
memory/2696-3-0x000000013F8C0000-0x0000000140C3A000-memory.dmp

Filesize
19.5MB

Download
memory/2696-37-0x000000013F8C0000-0x0000000140C3A000-memory.dmp

Filesize
19.5MB

Download
memory/2696-65-0x0000000077B30000-0x0000000077CD9000-memory.dmp

Filesize
1.7MB

Download
memory/2696-64-0x000000013F8C0000-0x0000000140C3A000-memory.dmp

Filesize
19.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads