7f19b0c0bc1ce4ce7b0bd072527f2feade5809d8de040c01945737534502a4de | Triage

Sharing

General

Target

Loader.exe
Size

13.3MB
Sample

240802-scwkeatcma
MD5

d3567c93fb7a218ad130542ac8b02a76
SHA1

e0f2e65b0eab58da6c26de403933ed6e22c0c364
SHA256

7f19b0c0bc1ce4ce7b0bd072527f2feade5809d8de040c01945737534502a4de
SHA512

a245ff8e8e6843298159ae207866df7f840865f02ac7c813faa9b7a5b1740b2b9bde496e98dc413f12597e96c5c8c62fde4845a774d904eb089070d80498be04
SSDEEP

196608:YTYz2RUiumFCR0F29+AFB1Au21QUhX2nUMhjIhK/gVCPxWrJerBtZEmla:EYz2RR69+an9WaUioVCPoozZN8

Score

9^/10

discovery evasion execution persistence trojan

Malware Config

Targets

- Target
  
  Loader.exe
- Size
  
  13.3MB
- MD5
  
  d3567c93fb7a218ad130542ac8b02a76
- SHA1
  
  e0f2e65b0eab58da6c26de403933ed6e22c0c364
- SHA256
  
  7f19b0c0bc1ce4ce7b0bd072527f2feade5809d8de040c01945737534502a4de
- SHA512
  
  a245ff8e8e6843298159ae207866df7f840865f02ac7c813faa9b7a5b1740b2b9bde496e98dc413f12597e96c5c8c62fde4845a774d904eb089070d80498be04
- SSDEEP
  
  196608:YTYz2RUiumFCR0F29+AFB1Au21QUhX2nUMhjIhK/gVCPxWrJerBtZEmla:EYz2RR69+an9WaUioVCPoozZN8
Score

9^/10

evasion execution persistence trojan discovery
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Creates new service(s)
  persistence execution
- Drops file in Drivers directory
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionexecutionpersistencetrojan

behavioral2

discoveryevasionexecutionpersistencetrojan