Overview

overview

9

Static

static

7

MWIII.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MWIII.exe

  • Size

    7.8MB

  • Sample

    241014-xen1kathrp

  • MD5

    b28690b408681225c9a2a5edd79b4733

  • SHA1

    6e96699ad95256ba20c43b6d7bfd4fb788439667

  • SHA256

    9ec35c201fc13a3aa957921d8a752ba6d893e6a0c8a427bbbcbd7951374531cf

  • SHA512

    9fdfdc5760515b69da479410fbca995ed760d468ea4c148538abf4fdc9290a8126b5573ec6de2234e5d46ceedcb0399a255a95852db5ef7d33a06ba6d9997fde

  • SSDEEP

    196608:z8EW0ZGL/vXQS8blnejwaAUnEawEuxRWA5G6yfQfdn79wX:YEtZsHXjGlejwa5n5wdxs+9FyX

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      MWIII.exe

    • Size

      7.8MB

    • MD5

      b28690b408681225c9a2a5edd79b4733

    • SHA1

      6e96699ad95256ba20c43b6d7bfd4fb788439667

    • SHA256

      9ec35c201fc13a3aa957921d8a752ba6d893e6a0c8a427bbbcbd7951374531cf

    • SHA512

      9fdfdc5760515b69da479410fbca995ed760d468ea4c148538abf4fdc9290a8126b5573ec6de2234e5d46ceedcb0399a255a95852db5ef7d33a06ba6d9997fde

    • SSDEEP

      196608:z8EW0ZGL/vXQS8blnejwaAUnEawEuxRWA5G6yfQfdn79wX:YEtZsHXjGlejwa5n5wdxs+9FyX

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks