77c54133f9c02b492c56056dd000b700ca32bc7990d1eb2190d65768f99be01b

General

Target

v5.exe
Size

15.8MB
MD5

3f520362308d33e2810e7a13e6d57e35
SHA1

b4a43ac54deaab2a5ad11258aa49a33652e28eb7
SHA256

77c54133f9c02b492c56056dd000b700ca32bc7990d1eb2190d65768f99be01b
SHA512

b1e0057b77dd148cbfe7d7f2c78f9632e1cc75dcbade64291a1193bff047cee753968706d09b8c88f3bdf065fb8e161c373983a3ecdf8839a21b5496f7763c8a
SSDEEP

393216:2l0ceFaaCz5/B0TUo+uwphgoHrQlDgn8LPDRyL:2HSaa+0CO+wDgn2

Score

9^/10

evasion themida trojan upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	v5_protected.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	v5_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	v5_protected.exe

Executes dropped EXE 4 IoCs

pid	Process
1220	v5_protected.exe
1608	Built.exe
2608	Built.exe
1224	Process not Found

Loads dropped DLL 7 IoCs

pid	Process
1300	v5.exe
2188	Process not Found
1300	v5.exe
1608	Built.exe
2608	Built.exe
1224	Process not Found
1224	Process not Found

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000b000000014aec-2.dat	themida
behavioral1/memory/1220-6-0x0000000140000000-0x0000000140A0F000-memory.dmp	themida
behavioral1/memory/1220-43-0x0000000140000000-0x0000000140A0F000-memory.dmp	themida
behavioral1/memory/1220-42-0x0000000140000000-0x0000000140A0F000-memory.dmp	themida
behavioral1/memory/1220-44-0x0000000140000000-0x0000000140A0F000-memory.dmp	themida
behavioral1/memory/1220-47-0x0000000140000000-0x0000000140A0F000-memory.dmp	themida
behavioral1/memory/1220-69-0x0000000140000000-0x0000000140A0F000-memory.dmp	themida

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000018698-37.dat	upx
behavioral1/memory/2608-39-0x000007FEF5700000-0x000007FEF5CF2000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	v5_protected.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1220	v5_protected.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1220	1300	v5.exe	28
PID 1300 wrote to memory of 1220	1300	v5.exe	28
PID 1300 wrote to memory of 1220	1300	v5.exe	28
PID 1300 wrote to memory of 1220	1300	v5.exe	28
PID 1300 wrote to memory of 1608	1300	v5.exe	30
PID 1300 wrote to memory of 1608	1300	v5.exe	30
PID 1300 wrote to memory of 1608	1300	v5.exe	30
PID 1300 wrote to memory of 1608	1300	v5.exe	30
PID 1608 wrote to memory of 2608	1608	Built.exe	31
PID 1608 wrote to memory of 2608	1608	Built.exe	31
PID 1608 wrote to memory of 2608	1608	Built.exe	31

C:\Users\Admin\AppData\Local\Temp\v5.exe
"C:\Users\Admin\AppData\Local\Temp\v5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\v5_protected.exe
  "C:\Users\Admin\AppData\Local\Temp\v5_protected.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1220
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI16082\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
\Users\Admin\AppData\Local\Temp\Built.exe

Filesize
7.4MB

MD5
2c628deb80a8e0564ab2880b28e18af1

SHA1
733f8d93a98fb60ce981de24deb7928fc2848e8d

SHA256
b1b3013a32c2d73a5144e0371065a91d04b8a3b227eaf3de75bf41078d903188

SHA512
8d75e415a11863bee4763b572729d8090a63fa9487550b45a28ba2723cb410735a5cf7e9dc5a3cf857bb0bddb3e7775cca018b4df2d78e77c2e5477fb3509054

Download Submit
\Users\Admin\AppData\Local\Temp\v5_protected.exe

Filesize
8.4MB

MD5
d35ddd967163e1b060e50300ef3f2d8d

SHA1
04b032ab3823e3eb7a4bfa98ea89398e698b40a3

SHA256
59d41f1efbe4f17e80020738139b0e9075a24c5cbc8d1d25f7b30ef20c0a60ff

SHA512
c18b830a66a866f2463b99a7513f8f4d19fc260b88bca8577862dfa2e357a0344a8f86a5929abf091e98310ef933a5b699979d7a1297fc27395e9bb7da651644

Download Submit
memory/1220-6-0x0000000140000000-0x0000000140A0F000-memory.dmp

Filesize
10.1MB

Download
memory/1220-43-0x0000000140000000-0x0000000140A0F000-memory.dmp

Filesize
10.1MB

Download
memory/1220-42-0x0000000140000000-0x0000000140A0F000-memory.dmp

Filesize
10.1MB

Download
memory/1220-44-0x0000000140000000-0x0000000140A0F000-memory.dmp

Filesize
10.1MB

Download
memory/1220-47-0x0000000140000000-0x0000000140A0F000-memory.dmp

Filesize
10.1MB

Download
memory/1220-69-0x0000000140000000-0x0000000140A0F000-memory.dmp

Filesize
10.1MB

Download
memory/1300-5-0x0000000003EA0000-0x00000000048AF000-memory.dmp

Filesize
10.1MB

Download
memory/2608-39-0x000007FEF5700000-0x000007FEF5CF2000-memory.dmp

Filesize
5.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads