d75c85cc482e76831346d065ece05c1bdb8d429a34e6f3354ebaba54fd77a03f | Triage

Sharing

General

Target

d75c85cc482e76831346d065ece05c1bdb8d429a34e6f3354ebaba54fd77a03f.exe
Size

2.7MB
Sample

241119-xgy9bavnaq
MD5

98c9f297a3fc0fed53eb96725da46086
SHA1

624dc0cb56dd12fed4e66018e1b7fd902916d892
SHA256

d75c85cc482e76831346d065ece05c1bdb8d429a34e6f3354ebaba54fd77a03f
SHA512

ac15e38106149b8a7b9bb5d53a81738db31a8fe38d5a11cbf0811d6eecfb102751948a8d45ea36eceac9a8e2e9efa1c51135bf2b5a6164af3a4853174538fde9
SSDEEP

49152:epHXZoK9QVOZWDCErw/VrVfW7THifJMtRltwZ:epHXZtOVOZWVrwNpW7TCxse

Score

10^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  d75c85cc482e76831346d065ece05c1bdb8d429a34e6f3354ebaba54fd77a03f.exe
- Size
  
  2.7MB
- MD5
  
  98c9f297a3fc0fed53eb96725da46086
- SHA1
  
  624dc0cb56dd12fed4e66018e1b7fd902916d892
- SHA256
  
  d75c85cc482e76831346d065ece05c1bdb8d429a34e6f3354ebaba54fd77a03f
- SHA512
  
  ac15e38106149b8a7b9bb5d53a81738db31a8fe38d5a11cbf0811d6eecfb102751948a8d45ea36eceac9a8e2e9efa1c51135bf2b5a6164af3a4853174538fde9
- SSDEEP
  
  49152:epHXZoK9QVOZWDCErw/VrVfW7THifJMtRltwZ:epHXZtOVOZWVrwNpW7TCxse
Score

10^/10

discovery evasion trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Windows security modification
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2

discoveryevasiontrojan