1c733ad7ed4f89826d675196abcc3a6133bb8f67c69d56e5fcb601ad521ff9f8

General

Target

864d1a4e41a56c8f2e7e7eec89a47638.exe
Size

3.6MB
MD5

864d1a4e41a56c8f2e7e7eec89a47638
SHA1

1f2cb906b92a945c7346c7139c7722230005c394
SHA256

1c733ad7ed4f89826d675196abcc3a6133bb8f67c69d56e5fcb601ad521ff9f8
SHA512

547a441369636e2548c7f8f94c3972269e04d80ee5a26803cc222942b28e457be908126fb4ff6bfde2a063ea1ef74ecba2aaceb58c68fba5c4fddcea5fbd91d3
SSDEEP

98304:nroESehXGx5IkVu1f/ihp+t49Rd3iG2dEsL:s3ehXzgiSvGiv3tEj

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	da_protected.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	da_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	da_protected.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	864d1a4e41a56c8f2e7e7eec89a47638.exe

Executes dropped EXE 1 IoCs

pid	Process
3960	da_protected.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0007000000023278-4.dat	themida
behavioral2/memory/3960-22-0x0000000000690000-0x0000000000FE8000-memory.dmp	themida
behavioral2/memory/3960-23-0x0000000000690000-0x0000000000FE8000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	da_protected.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3960	da_protected.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3960	da_protected.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 3960	4440	864d1a4e41a56c8f2e7e7eec89a47638.exe	83
PID 4440 wrote to memory of 3960	4440	864d1a4e41a56c8f2e7e7eec89a47638.exe	83
PID 4440 wrote to memory of 3960	4440	864d1a4e41a56c8f2e7e7eec89a47638.exe	83

C:\Users\Admin\AppData\Local\Temp\864d1a4e41a56c8f2e7e7eec89a47638.exe
"C:\Users\Admin\AppData\Local\Temp\864d1a4e41a56c8f2e7e7eec89a47638.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Users\Admin\AppData\Local\Temp\da_protected.exe
  "C:\Users\Admin\AppData\Local\Temp\da_protected.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\da_protected.exe

Filesize
3.2MB

MD5
3d21c714fbb98a6a3c72919928c9525c

SHA1
bf628293920b8f0418de008acc8f3506eaeff3cb

SHA256
811be420db2f390e60a291018126a8aa45c8c5182c050b13076c80d3f80d153c

SHA512
3b21fda899cf197a740dd4f2844c99c772a16ffe20581fe78e801c193f29714fbfa23843059ee34baf6176e71434f0ed7506d75de91b87348bcf9cc4b999575a

Download Submit
memory/3960-12-0x0000000000690000-0x0000000000FE8000-memory.dmp

Filesize
9.3MB

Download
memory/3960-13-0x00000000761E0000-0x00000000761E1000-memory.dmp

Filesize
4KB

Download
memory/3960-14-0x00000000761C0000-0x00000000762B0000-memory.dmp

Filesize
960KB

Download
memory/3960-15-0x00000000761C0000-0x00000000762B0000-memory.dmp

Filesize
960KB

Download
memory/3960-16-0x00000000761C0000-0x00000000762B0000-memory.dmp

Filesize
960KB

Download
memory/3960-17-0x00000000761C0000-0x00000000762B0000-memory.dmp

Filesize
960KB

Download
memory/3960-18-0x00000000761C0000-0x00000000762B0000-memory.dmp

Filesize
960KB

Download
memory/3960-19-0x00000000761C0000-0x00000000762B0000-memory.dmp

Filesize
960KB

Download
memory/3960-22-0x0000000000690000-0x0000000000FE8000-memory.dmp

Filesize
9.3MB

Download
memory/3960-23-0x0000000000690000-0x0000000000FE8000-memory.dmp

Filesize
9.3MB

Download
memory/3960-24-0x0000000005880000-0x000000000591C000-memory.dmp

Filesize
624KB

Download
memory/3960-26-0x0000000000690000-0x0000000000FE8000-memory.dmp

Filesize
9.3MB

Download
memory/3960-27-0x00000000761E0000-0x00000000761E1000-memory.dmp

Filesize
4KB

Download
memory/3960-28-0x00000000761C0000-0x00000000762B0000-memory.dmp

Filesize
960KB

Download
memory/3960-29-0x00000000761C0000-0x00000000762B0000-memory.dmp

Filesize
960KB

Download
memory/3960-31-0x00000000761C0000-0x00000000762B0000-memory.dmp

Filesize
960KB

Download
memory/3960-32-0x00000000761C0000-0x00000000762B0000-memory.dmp

Filesize
960KB

Download
memory/3960-33-0x00000000761C0000-0x00000000762B0000-memory.dmp

Filesize
960KB

Download
memory/3960-34-0x00000000761C0000-0x00000000762B0000-memory.dmp

Filesize
960KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads