b406141f1dbde4f0203ba31b565afac11bf6b6a14ce48abfdcee29e861b64d25 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

7

b406141f1d...25.exe

windows7-x64

9

b406141f1d...25.exe

windows10-2004-x64

9

Sharing

General

Target

b406141f1dbde4f0203ba31b565afac11bf6b6a14ce48abfdcee29e861b64d25
Size

3.2MB
Sample

241003-y75dpaycrg
MD5

40020515928df3bf6465d3b0717d72a3
SHA1

6ee242a4747c9bdb07b7efdce776f718ed83438b
SHA256

b406141f1dbde4f0203ba31b565afac11bf6b6a14ce48abfdcee29e861b64d25
SHA512

1462af6485242ec28bb03f1ca082ed554e7453991050a636f7f16d75c2aa245694ca67e02d60f543a88982a69601df3eb3faeea21e5133e4ae1f3ce15817dfee
SSDEEP

98304:Kl5CZcfd9n8FdepA6+21dNwL7pstDVSyryt:Klwqfjn8FCt11dKKtZS7

Score

9^/10

discovery evasion themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

b406141f1dbde4f0203ba31b565afac11bf6b6a14ce48abfdcee29e861b64d25.exe

Resource

win7-20240903-en

discovery evasion themida trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

b406141f1dbde4f0203ba31b565afac11bf6b6a14ce48abfdcee29e861b64d25.exe

Resource

win10v2004-20240802-en

discovery evasion themida trojan

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  b406141f1dbde4f0203ba31b565afac11bf6b6a14ce48abfdcee29e861b64d25
- Size
  
  3.2MB
- MD5
  
  40020515928df3bf6465d3b0717d72a3
- SHA1
  
  6ee242a4747c9bdb07b7efdce776f718ed83438b
- SHA256
  
  b406141f1dbde4f0203ba31b565afac11bf6b6a14ce48abfdcee29e861b64d25
- SHA512
  
  1462af6485242ec28bb03f1ca082ed554e7453991050a636f7f16d75c2aa245694ca67e02d60f543a88982a69601df3eb3faeea21e5133e4ae1f3ce15817dfee
- SSDEEP
  
  98304:Kl5CZcfd9n8FdepA6+21dNwL7pstDVSyryt:Klwqfjn8FCt11dKKtZS7
Score

9^/10

discovery evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionthemidatrojan

behavioral2

discoveryevasionthemidatrojan

© 2018-2025

Terms | Privacy