Overview

overview

9

Static

static

3

b57420ac82...f5.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b57420ac8259e8bec20f75a174a515f5.bin

  • Size

    6.1MB

  • Sample

    241105-y9wjkaxgnh

  • MD5

    b57420ac8259e8bec20f75a174a515f5

  • SHA1

    71170f2390bad64813425cdc4436898cfe2ad8b0

  • SHA256

    e4c6952ea4b5812039fa6a741b66b151afd1863b926b1697dabe7b5605f4dd5a

  • SHA512

    14a47c791d6e7cac1c087a7bd43068f4e9bf9bd5ae0086a6e39016c6a4489b2ed8e6b296fbdcdc0d38f41c7d899942ad92c32e8aea9a46c374fc71445c2127ef

  • SSDEEP

    98304:VeRmIPtRUnaZCS52hb+5wg/pfTEzeAFNb2OkV/FH4MdvDp1WPXuyL:gPtRzQjaWqBYFNCOktBHdvDsv

Score
9/10
paypalsteamdiscoveryevasionpersistencephishingthemidatrojan

Malware Config

Targets

    • Target

      b57420ac8259e8bec20f75a174a515f5.bin

    • Size

      6.1MB

    • MD5

      b57420ac8259e8bec20f75a174a515f5

    • SHA1

      71170f2390bad64813425cdc4436898cfe2ad8b0

    • SHA256

      e4c6952ea4b5812039fa6a741b66b151afd1863b926b1697dabe7b5605f4dd5a

    • SHA512

      14a47c791d6e7cac1c087a7bd43068f4e9bf9bd5ae0086a6e39016c6a4489b2ed8e6b296fbdcdc0d38f41c7d899942ad92c32e8aea9a46c374fc71445c2127ef

    • SSDEEP

      98304:VeRmIPtRUnaZCS52hb+5wg/pfTEzeAFNb2OkV/FH4MdvDp1WPXuyL:gPtRzQjaWqBYFNCOktBHdvDsv

    Score
    9/10
    paypalsteamdiscoveryevasionpersistencephishingthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Detected potential entity reuse from brand PAYPAL.

      phishingpaypal

    • Detected potential entity reuse from brand STEAM.

      phishingsteam

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Browser Information Discovery

1
T1217

Query Registry

3
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks