94a5ce690a94c018e35d0562541520f43535cc393d5e0da746e524e04d086a8d

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

loader.exe
Size

8.5MB
MD5

851dc1231b62cca3b63f7f2287dff84f
SHA1

16915a97ff71586cb033319a3f81c18d8792e1b7
SHA256

2019edf4b004995ed0cc16da5a8746a6154b16df7663cbe6d3fc7782ba5dbc17
SHA512

507c6038f9b65ccb74fe6947ac9caeeef35dcc1b0d01fd68e10a7d2cc5cf6997bdd04cb10b1cc25fd2966b266c7ff471f91618da6021ef4cd0ba24803c7482f9
SSDEEP

196608:lWU/XIK3djYTPtJyCAaws5WJqHqJLkSXNzeHrldm:lWU/4kU7tJy7DhJQyNSLl4

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	loader.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	loader.exe

Executes dropped EXE 1 IoCs

pid	Process
2596	loader.exe

Loads dropped DLL 2 IoCs

pid	Process
1916	loader.exe
2596	loader.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral7/memory/1916-0-0x000000013F120000-0x000000013FF73000-memory.dmp	themida
behavioral7/memory/1916-1-0x000000013F120000-0x000000013FF73000-memory.dmp	themida
behavioral7/memory/1916-2-0x000000013F120000-0x000000013FF73000-memory.dmp	themida
behavioral7/memory/1916-3-0x000000013F120000-0x000000013FF73000-memory.dmp	themida
behavioral7/memory/1916-6-0x000000013F120000-0x000000013FF73000-memory.dmp	themida
behavioral7/memory/1916-5-0x000000013F120000-0x000000013FF73000-memory.dmp	themida
behavioral7/memory/1916-4-0x000000013F120000-0x000000013FF73000-memory.dmp	themida
behavioral7/memory/1916-112-0x000000013F120000-0x000000013FF73000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2596	1916	loader.exe	29
PID 1916 wrote to memory of 2596	1916	loader.exe	29
PID 1916 wrote to memory of 2596	1916	loader.exe	29

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\onefile_1916_133611384676426000\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_1916_133611384676426000\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_1916_133611384676426000\loader.exe

Filesize
8.5MB

MD5
49c7d8a33d1b2ff955d0730e84e8cd6c

SHA1
f1429fbe357102901cab5ba7d20673fb0fb7db6b

SHA256
ee42078cbd223280c0427036e5ae79ddfbe7dc2c7f4b5f7ea778bf12a5867fb1

SHA512
7b7fd45336ae246e488fd4b989e8bc4f40d8ee621cf75bcc722f7d6cde0556dddc8cc3b0375593d4e50d4566cbeb3f011c0865fef38d203cb0e1e9f20ee7be4f

Download Submit
memory/1916-0-0x000000013F120000-0x000000013FF73000-memory.dmp

Filesize
14.3MB

Download
memory/1916-1-0x000000013F120000-0x000000013FF73000-memory.dmp

Filesize
14.3MB

Download
memory/1916-2-0x000000013F120000-0x000000013FF73000-memory.dmp

Filesize
14.3MB

Download
memory/1916-3-0x000000013F120000-0x000000013FF73000-memory.dmp

Filesize
14.3MB

Download
memory/1916-6-0x000000013F120000-0x000000013FF73000-memory.dmp

Filesize
14.3MB

Download
memory/1916-5-0x000000013F120000-0x000000013FF73000-memory.dmp

Filesize
14.3MB

Download
memory/1916-4-0x000000013F120000-0x000000013FF73000-memory.dmp

Filesize
14.3MB

Download
memory/1916-112-0x000000013F120000-0x000000013FF73000-memory.dmp

Filesize
14.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads