Overview

overview

9

Static

static

7

Monolith.exe

windows10-1703-x64

9

Monolith.exe

windows10-2004-x64

9

Monolith.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    33s
  • max time network
    31s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19-08-2024 00:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Monolith.exe

  • Size

    3.9MB

  • MD5

    07dc38e53039d72d14e1cbca9856ba5b

  • SHA1

    d3a981998c26f59d08090150a813d5ab27e53526

  • SHA256

    d7435449ef4aecbd126115316045b002cb5aecfbcd6cbed9f3cbe62114502060

  • SHA512

    0b96bd20778d8524602de2ce6027500d8412b5fc8d00d3af34a954b55c82cc9d59fc988ffbf78a9e3866dae8862158ca31f1bd5e516527a8857d240f2df4c465

  • SSDEEP

    98304:uw8woLTfmptqpaKjSVO+Pm5hXvAPAtXI08y4OfcswrxhKAqLB/JsSYOkM:uwuH+pMP4Pk9vuAtXp8HOkBdhpqBJWQ

Score
9/10
evasionthemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Monolith.exe
    "C:\Users\Admin\AppData\Local\Temp\Monolith.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:4184
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4844
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:4852
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1720
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4596
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:1948
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3568
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:1608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XTX3UCPX\favicon[1].ico
    Filesize

    23KB

    MD5

    ec2c34cadd4b5f4594415127380a85e6

    SHA1

    e7e129270da0153510ef04a148d08702b980b679

    SHA256

    128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

    SHA512

    c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\5wlq519\imagestore.dat
    Filesize

    24KB

    MD5

    19fa32f50337ae8c84bae96e5dc31272

    SHA1

    a028522e177a60be6af14b3d55a36038bb458f26

    SHA256

    05b0e7a4132286da0a7434eb40d5f4763706b924a6e945979423662e346e4dea

    SHA512

    d70c92437c4ce873abeb2fb06a98e84d8eebdafd7c2f623816ce392f5d3f0480f1f787e32389a0243eb7f34ec097cb39e6a7f9f10a89e5df5d10913e7886df1e

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFDE0C9EFC76514C0F.TMP
    Filesize

    24KB

    MD5

    d3cdb7663712ddb6ef5056c72fe69e86

    SHA1

    f08bf69934fb2b9ca0aba287c96abe145a69366c

    SHA256

    3e8c2095986b262ac8fccfabda2d021fc0d3504275e83cffe1f0a333f9efbe15

    SHA512

    c0acd65db7098a55dae0730eb1dcd8aa94e95a71f39dd40b087be0b06afc5d1bb310f555781853b5a78a8803dba0fb44df44bd2bb14baeca29c7c7410dffc812

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
    Filesize

    1KB

    MD5

    2c6866234c2b2205181d8808be3b5206

    SHA1

    78e70428d546067914be84a736979154fb893f06

    SHA256

    a148b7ba061105ee50e31584d4c4b5feb80e3bd7ed2afd63c5b782684c01e7aa

    SHA512

    ce62c31faf8f383490798bd4dba49ba2e79771772337afcffa580154d1d45c63eaeb435ccae8fa94f61989de3c15f6f8574cc69838993f318a2532694ef588ea

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
    Filesize

    408B

    MD5

    4b714f8b16d0060bc109467d52d31bc5

    SHA1

    883b763347517ba5639da9096ed1ff6a31a6fdba

    SHA256

    932c65d9f1b71f116cb6d65f22edd43909f5c85b5b187d70c3a1540438743c89

    SHA512

    38a05391dc913815bad462be01e5692ddc106473b22eb9cbbb68eddc8d985260c0280ad7f9765f2e5af409f8c67f809b950645626d422f56793aaf069696e293

    Download Submit

  • memory/1608-65-0x000002BEF1C00000-0x000002BEF1D00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1608-81-0x000002BEF3550000-0x000002BEF3552000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1608-77-0x000002BEF3510000-0x000002BEF3512000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1608-79-0x000002BEF3530000-0x000002BEF3532000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4184-52-0x0000000140000000-0x0000000140A49000-memory.dmp

    Filesize

    10.3MB

    Download

  • memory/4184-126-0x0000000140000000-0x0000000140A49000-memory.dmp

    Filesize

    10.3MB

    Download

  • memory/4184-196-0x0000000140000000-0x0000000140A49000-memory.dmp

    Filesize

    10.3MB

    Download

  • memory/4184-1-0x00007FFBEEA98000-0x00007FFBEEA9A000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4184-2-0x0000000140000000-0x0000000140A49000-memory.dmp

    Filesize

    10.3MB

    Download

  • memory/4184-0-0x0000000140000000-0x0000000140A49000-memory.dmp

    Filesize

    10.3MB

    Download

  • memory/4184-3-0x0000000140000000-0x0000000140A49000-memory.dmp

    Filesize

    10.3MB

    Download

  • memory/4184-53-0x0000000140000000-0x0000000140A49000-memory.dmp

    Filesize

    10.3MB

    Download

  • memory/4596-48-0x00000163C4D00000-0x00000163C4E00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4596-49-0x00000163C4D00000-0x00000163C4E00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4596-47-0x00000163C4D00000-0x00000163C4E00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4844-138-0x0000014C61690000-0x0000014C61691000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4844-137-0x0000014C61680000-0x0000014C61681000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4844-20-0x0000014C5B020000-0x0000014C5B030000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4844-183-0x0000014C5F250000-0x0000014C5F252000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4844-186-0x0000014C5A1F0000-0x0000014C5A1F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4844-190-0x0000014C583F0000-0x0000014C583F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4844-4-0x0000014C5AF20000-0x0000014C5AF30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4844-39-0x0000014C5A1A0000-0x0000014C5A1A2000-memory.dmp

    Filesize

    8KB

    Download