Overview

overview

9

Static

static

7

Twisted.exe

windows7-x64

9

Twisted.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Twisted.exe

  • Size

    5.1MB

  • Sample

    240818-env65avapf

  • MD5

    e5770eae6267ab9ba53718c9202883a9

  • SHA1

    f70826e588182fe03f10510df41c7341c81de99c

  • SHA256

    5af0b5326fdc164f0bc6c4f9e10959e523b15b2fec6c882a93863e08f26041ef

  • SHA512

    8b8c94a7f18a3c2e60162396780908a419ee876ad62c5dc933db858ed335b2b1b670fe63c62b8cde416c02b9a5e191bca2eb7e972b06cfc7cfa93a93562faae5

  • SSDEEP

    98304:J1ejTMD5b6DV596t4w/wNLAtL4dTQqq0WMZVA1H+:j+Kb6DV596BoNLTQMWQVAh

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      Twisted.exe

    • Size

      5.1MB

    • MD5

      e5770eae6267ab9ba53718c9202883a9

    • SHA1

      f70826e588182fe03f10510df41c7341c81de99c

    • SHA256

      5af0b5326fdc164f0bc6c4f9e10959e523b15b2fec6c882a93863e08f26041ef

    • SHA512

      8b8c94a7f18a3c2e60162396780908a419ee876ad62c5dc933db858ed335b2b1b670fe63c62b8cde416c02b9a5e191bca2eb7e972b06cfc7cfa93a93562faae5

    • SSDEEP

      98304:J1ejTMD5b6DV596t4w/wNLAtL4dTQqq0WMZVA1H+:j+Kb6DV596BoNLTQMWQVAh

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks