f4c75f66e97391588e6c2c87c59bb951f515fc04187b0fbba8d3b78f8ba86b36

General

Target

lmao.rar
Size

19.4MB
MD5

daef1c17e11577bcabe74ceec366b4e3
SHA1

6325d337fac9cb91fbe89807fb75387ce2e6e4c1
SHA256

f4c75f66e97391588e6c2c87c59bb951f515fc04187b0fbba8d3b78f8ba86b36
SHA512

cfe0ea0f96acedd41a3cbe3a88454d22eaa7575b48bddd09e5924e41a175f5b8124af0094d151e033b7247490fb1024e721afecb9d83d9ae42fa6722484cc21b
SSDEEP

393216:gH2ExgZOWSfo38qTAMLflnkExp8KM7aAEKRDPpaqEIXhWspu1C1N0uht8:gWxZOU8qTVL9kq8KM7auTwspu1kj8

Score

9^/10

discovery evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	applecleaner.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	applecleaner.exe

Executes dropped EXE 2 IoCs

pid	Process
4832	lcb.vmp.exe
4636	applecleaner.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000700000001da66-12.dat	themida
behavioral1/memory/4636-13-0x00007FF61F2C0000-0x00007FF61FC62000-memory.dmp	themida
behavioral1/memory/4636-15-0x00007FF61F2C0000-0x00007FF61FC62000-memory.dmp	themida
behavioral1/memory/4636-17-0x00007FF61F2C0000-0x00007FF61FC62000-memory.dmp	themida
behavioral1/memory/4636-16-0x00007FF61F2C0000-0x00007FF61FC62000-memory.dmp	themida
behavioral1/memory/4636-18-0x00007FF61F2C0000-0x00007FF61FC62000-memory.dmp	themida
behavioral1/memory/4636-19-0x00007FF61F2C0000-0x00007FF61FC62000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	applecleaner.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4636	applecleaner.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1428	cmd.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
4476	taskkill.exe
3192	taskkill.exe
3184	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	960	7zG.exe
Token: 35	960	7zG.exe
Token: SeSecurityPrivilege	960	7zG.exe
Token: SeSecurityPrivilege	960	7zG.exe
Token: SeDebugPrivilege	4476	taskkill.exe
Token: SeDebugPrivilege	3192	taskkill.exe
Token: SeDebugPrivilege	3184	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
960	7zG.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4636	applecleaner.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 812	4636	applecleaner.exe	109
PID 4636 wrote to memory of 812	4636	applecleaner.exe	109
PID 812 wrote to memory of 4476	812	cmd.exe	110
PID 812 wrote to memory of 4476	812	cmd.exe	110
PID 4636 wrote to memory of 1428	4636	applecleaner.exe	111
PID 4636 wrote to memory of 1428	4636	applecleaner.exe	111
PID 1428 wrote to memory of 3192	1428	cmd.exe	112
PID 1428 wrote to memory of 3192	1428	cmd.exe	112
PID 4636 wrote to memory of 4904	4636	applecleaner.exe	113
PID 4636 wrote to memory of 4904	4636	applecleaner.exe	113
PID 4904 wrote to memory of 3184	4904	cmd.exe	114
PID 4904 wrote to memory of 3184	4904	cmd.exe	114

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lmao.rar
1⤵
- Modifies registry class
PID:4844

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4984

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap30562:66:7zEvent2936
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:960

C:\Users\Admin\Desktop\lmao\lcb.vmp.exe
"C:\Users\Admin\Desktop\lmao\lcb.vmp.exe"
1⤵
- Executes dropped EXE
PID:4832

C:\Users\Admin\Desktop\lmao\cleanernew\applecleaner.exe
"C:\Users\Admin\Desktop\lmao\cleanernew\applecleaner.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Battle.net.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\lmao\cleanernew\applecleaner.exe

Filesize
3.6MB

MD5
f96eb2236970fb3ea97101b923af4228

SHA1
e0eed80f1054acbf5389a7b8860a4503dd3e184a

SHA256
46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172

SHA512
2fd2d28c5f571d40b43a4dd7a22d367ba42420c29627f21ca0a2052070ffb9f689d80dad638238189eed26ed19af626f47e70f1207e10007041c620dac323cc7

Download Submit
C:\Users\Admin\Desktop\lmao\lcb.vmp.exe

Filesize
17.6MB

MD5
1cb693f6928bda0c2ebf52c6e5ffe668

SHA1
f004be3bbc2b101601911eb7885ed5f6a4ea1fff

SHA256
87da7e0260a855fc58b24196cf5a0b17a97afc734717dfef502fe0c68e37f516

SHA512
2bdc104f291aee272ec837bc3dc132e090da8ad100b72c8de53b36461371fc86ebf7205873e3303d89d3de883014b401147d3d3b9562de3d2f8bca3d94c52381

Download Submit
memory/4636-13-0x00007FF61F2C0000-0x00007FF61FC62000-memory.dmp

Filesize
9.6MB

Download
memory/4636-15-0x00007FF61F2C0000-0x00007FF61FC62000-memory.dmp

Filesize
9.6MB

Download
memory/4636-17-0x00007FF61F2C0000-0x00007FF61FC62000-memory.dmp

Filesize
9.6MB

Download
memory/4636-16-0x00007FF61F2C0000-0x00007FF61FC62000-memory.dmp

Filesize
9.6MB

Download
memory/4636-18-0x00007FF61F2C0000-0x00007FF61FC62000-memory.dmp

Filesize
9.6MB

Download
memory/4636-19-0x00007FF61F2C0000-0x00007FF61FC62000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads