9f60a00eedeee1b382a1ee47209c8c056a4ebbfbf45726aaa1f0909371b3ca9e

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LoaderDownloader.exe
Size

592KB
MD5

f25f8c6de26e307e7c49936c880b0ac7
SHA1

7e154481d7a98aa7c6d4c9fd0ed2e9399623704a
SHA256

c8f2d4f58c3a7cf294d8e2a57a1e14047db191c126b6806c347f2ab9a3ea4dd0
SHA512

43ef0f1c9563acd5627e6839efb6387b771d35dbd235e7cb87f76ed06f3b8e76f6033b213fb9cae88272930697834d746a3d06d7be24a04da6a5828a5168b3b2
SSDEEP

12288:XTPHl0zka+1bz11XXCL+OzL5ybnG22xATL4jQB:jPHl0zka+1n11XXo+OzL5ybnG22uz

Score

8^/10

themida

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3004	zgbwfNgItP.exe

Loads dropped DLL 1 IoCs

pid	Process
2808	cmd.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x002e0000000186de-19.dat	themida
behavioral1/memory/3004-23-0x000000013F040000-0x000000013FED3000-memory.dmp	themida

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2572	2652	LoaderDownloader.exe	32
PID 2652 wrote to memory of 2572	2652	LoaderDownloader.exe	32
PID 2652 wrote to memory of 2572	2652	LoaderDownloader.exe	32
PID 2652 wrote to memory of 2760	2652	LoaderDownloader.exe	33
PID 2652 wrote to memory of 2760	2652	LoaderDownloader.exe	33
PID 2652 wrote to memory of 2760	2652	LoaderDownloader.exe	33
PID 2652 wrote to memory of 2792	2652	LoaderDownloader.exe	34
PID 2652 wrote to memory of 2792	2652	LoaderDownloader.exe	34
PID 2652 wrote to memory of 2792	2652	LoaderDownloader.exe	34
PID 2652 wrote to memory of 2592	2652	LoaderDownloader.exe	35
PID 2652 wrote to memory of 2592	2652	LoaderDownloader.exe	35
PID 2652 wrote to memory of 2592	2652	LoaderDownloader.exe	35
PID 2652 wrote to memory of 2600	2652	LoaderDownloader.exe	36
PID 2652 wrote to memory of 2600	2652	LoaderDownloader.exe	36
PID 2652 wrote to memory of 2600	2652	LoaderDownloader.exe	36
PID 2652 wrote to memory of 1720	2652	LoaderDownloader.exe	37
PID 2652 wrote to memory of 1720	2652	LoaderDownloader.exe	37
PID 2652 wrote to memory of 1720	2652	LoaderDownloader.exe	37
PID 2652 wrote to memory of 2720	2652	LoaderDownloader.exe	38
PID 2652 wrote to memory of 2720	2652	LoaderDownloader.exe	38
PID 2652 wrote to memory of 2720	2652	LoaderDownloader.exe	38
PID 2652 wrote to memory of 2548	2652	LoaderDownloader.exe	39
PID 2652 wrote to memory of 2548	2652	LoaderDownloader.exe	39
PID 2652 wrote to memory of 2548	2652	LoaderDownloader.exe	39
PID 2652 wrote to memory of 2556	2652	LoaderDownloader.exe	40
PID 2652 wrote to memory of 2556	2652	LoaderDownloader.exe	40
PID 2652 wrote to memory of 2556	2652	LoaderDownloader.exe	40
PID 2652 wrote to memory of 2564	2652	LoaderDownloader.exe	41
PID 2652 wrote to memory of 2564	2652	LoaderDownloader.exe	41
PID 2652 wrote to memory of 2564	2652	LoaderDownloader.exe	41
PID 2652 wrote to memory of 2576	2652	LoaderDownloader.exe	42
PID 2652 wrote to memory of 2576	2652	LoaderDownloader.exe	42
PID 2652 wrote to memory of 2576	2652	LoaderDownloader.exe	42
PID 2652 wrote to memory of 2616	2652	LoaderDownloader.exe	43
PID 2652 wrote to memory of 2616	2652	LoaderDownloader.exe	43
PID 2652 wrote to memory of 2616	2652	LoaderDownloader.exe	43
PID 2652 wrote to memory of 2664	2652	LoaderDownloader.exe	44
PID 2652 wrote to memory of 2664	2652	LoaderDownloader.exe	44
PID 2652 wrote to memory of 2664	2652	LoaderDownloader.exe	44
PID 2652 wrote to memory of 336	2652	LoaderDownloader.exe	45
PID 2652 wrote to memory of 336	2652	LoaderDownloader.exe	45
PID 2652 wrote to memory of 336	2652	LoaderDownloader.exe	45
PID 2652 wrote to memory of 3012	2652	LoaderDownloader.exe	46
PID 2652 wrote to memory of 3012	2652	LoaderDownloader.exe	46
PID 2652 wrote to memory of 3012	2652	LoaderDownloader.exe	46
PID 2652 wrote to memory of 3016	2652	LoaderDownloader.exe	47
PID 2652 wrote to memory of 3016	2652	LoaderDownloader.exe	47
PID 2652 wrote to memory of 3016	2652	LoaderDownloader.exe	47
PID 2652 wrote to memory of 2848	2652	LoaderDownloader.exe	48
PID 2652 wrote to memory of 2848	2652	LoaderDownloader.exe	48
PID 2652 wrote to memory of 2848	2652	LoaderDownloader.exe	48
PID 2652 wrote to memory of 2136	2652	LoaderDownloader.exe	49
PID 2652 wrote to memory of 2136	2652	LoaderDownloader.exe	49
PID 2652 wrote to memory of 2136	2652	LoaderDownloader.exe	49
PID 2652 wrote to memory of 3064	2652	LoaderDownloader.exe	50
PID 2652 wrote to memory of 3064	2652	LoaderDownloader.exe	50
PID 2652 wrote to memory of 3064	2652	LoaderDownloader.exe	50
PID 2652 wrote to memory of 580	2652	LoaderDownloader.exe	51
PID 2652 wrote to memory of 580	2652	LoaderDownloader.exe	51
PID 2652 wrote to memory of 580	2652	LoaderDownloader.exe	51
PID 2652 wrote to memory of 1944	2652	LoaderDownloader.exe	52
PID 2652 wrote to memory of 1944	2652	LoaderDownloader.exe	52
PID 2652 wrote to memory of 1944	2652	LoaderDownloader.exe	52
PID 2652 wrote to memory of 696	2652	LoaderDownloader.exe	53

C:\Users\Admin\AppData\Local\Temp\LoaderDownloader.exe
"C:\Users\Admin\AppData\Local\Temp\LoaderDownloader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp/zgbwfNgItP.exe
  2⤵
  - Loads dropped DLL
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\zgbwfNgItP.exe
    C:\Users\Admin\AppData\Local\Temp/zgbwfNgItP.exe
    3⤵
    - Executes dropped EXE
    PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\zgbwfNgItP.exe

Filesize
5.5MB

MD5
ca096f8ecd2aa7d0da1ec6b4ab8495a5

SHA1
7e1f58e90495d69a6fb193e9d8251fdb2273a3e2

SHA256
7e0259b5cccd9511e26ad15203490fb68c7e81f0be06973400adf24074690f92

SHA512
29f8a261ca76b26104938ac1bf133f52a0f36c7dd1926819a55ac08a2d2e8a6acd5809f1b8f69339d74a6c090f4a926a4c64f84275be760aac04e6faf068fda5

Download Submit
memory/2808-22-0x000000013F040000-0x000000013FED3000-memory.dmp

Filesize
14.6MB

Download
memory/3004-23-0x000000013F040000-0x000000013FED3000-memory.dmp

Filesize
14.6MB

Download