53cbf6e8136b46bccacc78871cb92efb13c6eaaf555b71493fd749aedab63a1f | Triage

Sharing

General

Target

53cbf6e8136b46bccacc78871cb92efb13c6eaaf555b71493fd749aedab63a1f.exe
Size

2.7MB
Sample

241120-c7wwnatmfl
MD5

2391bf7c8409b5125fb9143f75a7d052
SHA1

7729b100845ec6ff313d70d261f51acd31e1427f
SHA256

53cbf6e8136b46bccacc78871cb92efb13c6eaaf555b71493fd749aedab63a1f
SHA512

c21ee402731beb7f15a7a9b7ee6177a57048f830995689796c372eeaacb8d5b7b88479cbb96d13867f73c19836c34a17c84a631da23fce181d45eac094604697
SSDEEP

24576:GH3FGG4n2ED5ziH27pagmRyXMi9pha+uNKhk9zoVun6tk0BYa48tsK1ZSeE5XapM:sg/NzfWEv7y+k0PMKP+EkWAIYMwzWVQ

Score

10^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  53cbf6e8136b46bccacc78871cb92efb13c6eaaf555b71493fd749aedab63a1f.exe
- Size
  
  2.7MB
- MD5
  
  2391bf7c8409b5125fb9143f75a7d052
- SHA1
  
  7729b100845ec6ff313d70d261f51acd31e1427f
- SHA256
  
  53cbf6e8136b46bccacc78871cb92efb13c6eaaf555b71493fd749aedab63a1f
- SHA512
  
  c21ee402731beb7f15a7a9b7ee6177a57048f830995689796c372eeaacb8d5b7b88479cbb96d13867f73c19836c34a17c84a631da23fce181d45eac094604697
- SSDEEP
  
  24576:GH3FGG4n2ED5ziH27pagmRyXMi9pha+uNKhk9zoVun6tk0BYa48tsK1ZSeE5XapM:sg/NzfWEv7y+k0PMKP+EkWAIYMwzWVQ
Score

10^/10

discovery evasion trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Windows security modification
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2

discoveryevasiontrojan