58d91d1cbe86643d2e638a2554e35479a88c289c7efb527abc4685ea7f281df5

Analysis

max time kernel
10s
max time network
5s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nyxia.exe
Size

3.3MB
MD5

51393a0442f9c01f59a597b1218887c8
SHA1

2b48afc21ab4a30dd6b8ce4d8907c9062fb4d95c
SHA256

19bddef132af20da74c89fb263b1ae89f9762eba06382e69cccdfc9048e45917
SHA512

f492083b0b3cb86b4367da9fd7040b49de9d9643fef7f61b77815f761b0bec9eae3a61fdebe549ff1f9cf97c8b53cd7f7c44df4501f9a0f9baca87b502ac9de2
SSDEEP

49152:ZPk827hGqT5yCL8FBo+IvuxVDK5rdynF4hNhLus6E9ku/8vpsS2vaovBlZ58aotR:Z88ypGOV0sPuvpsSIaM50tZjlBtB4I

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nyxia.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nyxia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nyxia.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1768-0-0x000000013FB00000-0x0000000140401000-memory.dmp	themida
behavioral1/memory/1768-2-0x000000013FB00000-0x0000000140401000-memory.dmp	themida
behavioral1/memory/1768-3-0x000000013FB00000-0x0000000140401000-memory.dmp	themida
behavioral1/memory/1768-5-0x000000013FB00000-0x0000000140401000-memory.dmp	themida
behavioral1/memory/1768-4-0x000000013FB00000-0x0000000140401000-memory.dmp	themida
behavioral1/memory/1768-6-0x000000013FB00000-0x0000000140401000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nyxia.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1768	nyxia.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1768	nyxia.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2352	1768	nyxia.exe	29
PID 1768 wrote to memory of 2352	1768	nyxia.exe	29
PID 1768 wrote to memory of 2352	1768	nyxia.exe	29

C:\Users\Admin\AppData\Local\Temp\nyxia.exe
"C:\Users\Admin\AppData\Local\Temp\nyxia.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1768 -s 200
  2⤵
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-0-0x000000013FB00000-0x0000000140401000-memory.dmp

Filesize
9.0MB

Download
memory/1768-1-0x00000000770A0000-0x00000000770A2000-memory.dmp

Filesize
8KB

Download
memory/1768-2-0x000000013FB00000-0x0000000140401000-memory.dmp

Filesize
9.0MB

Download
memory/1768-3-0x000000013FB00000-0x0000000140401000-memory.dmp

Filesize
9.0MB

Download
memory/1768-5-0x000000013FB00000-0x0000000140401000-memory.dmp

Filesize
9.0MB

Download
memory/1768-4-0x000000013FB00000-0x0000000140401000-memory.dmp

Filesize
9.0MB

Download
memory/1768-6-0x000000013FB00000-0x0000000140401000-memory.dmp

Filesize
9.0MB

Download