85a8fb1a3141fdca3588330bd8945a8775af26f0a145ed61e68bcd351915b25a

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

loader.exe
Size

18.8MB
MD5

8bba02b9071196c8b1681eb086e699b3
SHA1

adc78b8c976c3e9f52f57c760b3047e3c91fb389
SHA256

85a8fb1a3141fdca3588330bd8945a8775af26f0a145ed61e68bcd351915b25a
SHA512

06aa6c03a256489039276ee091ef346112ad7a225b97fac803f8288f927a65fc68d7f3421c3e8bf9d82236d6805688d40a5ba5bce2ea61821867edccebbc3436
SSDEEP

393216:MxsYJZy/ER2j9dkgZ3lNQdTVng6//XWIDCF/BilP+U7AY5zE3qsw5:MxDy/ZrQFVnZ3XWQCNBil2U7AY5zEu

Score

9^/10

evasion persistence privilege_escalation themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	loader.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	loader.exe

Deletes itself 1 IoCs

pid	Process
3060	cmd.exe

Themida packer 11 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2908-0-0x000000013FA30000-0x0000000142E7C000-memory.dmp	themida
behavioral1/memory/2908-2-0x000000013FA30000-0x0000000142E7C000-memory.dmp	themida
behavioral1/memory/2908-4-0x000000013FA30000-0x0000000142E7C000-memory.dmp	themida
behavioral1/memory/2908-3-0x000000013FA30000-0x0000000142E7C000-memory.dmp	themida
behavioral1/memory/2908-5-0x000000013FA30000-0x0000000142E7C000-memory.dmp	themida
behavioral1/memory/2908-7-0x000000013FA30000-0x0000000142E7C000-memory.dmp	themida
behavioral1/memory/2908-8-0x000000013FA30000-0x0000000142E7C000-memory.dmp	themida
behavioral1/memory/2908-6-0x000000013FA30000-0x0000000142E7C000-memory.dmp	themida
behavioral1/memory/2908-10-0x000000013FA30000-0x0000000142E7C000-memory.dmp	themida
behavioral1/memory/2908-11-0x000000013FA30000-0x0000000142E7C000-memory.dmp	themida
behavioral1/memory/2908-15-0x000000013FA30000-0x0000000142E7C000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2908	loader.exe
2908	loader.exe
2908	loader.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1612	timeout.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
988	ipconfig.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1720	taskkill.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1664	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	taskkill.exe
Token: SeDebugPrivilege	1664	taskmgr.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe
1664	taskmgr.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2516	2908	loader.exe	31
PID 2908 wrote to memory of 2516	2908	loader.exe	31
PID 2908 wrote to memory of 2516	2908	loader.exe	31
PID 2516 wrote to memory of 988	2516	cmd.exe	33
PID 2516 wrote to memory of 988	2516	cmd.exe	33
PID 2516 wrote to memory of 988	2516	cmd.exe	33
PID 2908 wrote to memory of 544	2908	loader.exe	34
PID 2908 wrote to memory of 544	2908	loader.exe	34
PID 2908 wrote to memory of 544	2908	loader.exe	34
PID 544 wrote to memory of 2156	544	cmd.exe	36
PID 544 wrote to memory of 2156	544	cmd.exe	36
PID 544 wrote to memory of 2156	544	cmd.exe	36
PID 2908 wrote to memory of 2976	2908	loader.exe	37
PID 2908 wrote to memory of 2976	2908	loader.exe	37
PID 2908 wrote to memory of 2976	2908	loader.exe	37
PID 2976 wrote to memory of 2840	2976	cmd.exe	39
PID 2976 wrote to memory of 2840	2976	cmd.exe	39
PID 2976 wrote to memory of 2840	2976	cmd.exe	39
PID 2908 wrote to memory of 2984	2908	loader.exe	40
PID 2908 wrote to memory of 2984	2908	loader.exe	40
PID 2908 wrote to memory of 2984	2908	loader.exe	40
PID 2984 wrote to memory of 2836	2984	cmd.exe	42
PID 2984 wrote to memory of 2836	2984	cmd.exe	42
PID 2984 wrote to memory of 2836	2984	cmd.exe	42
PID 2908 wrote to memory of 2828	2908	loader.exe	43
PID 2908 wrote to memory of 2828	2908	loader.exe	43
PID 2908 wrote to memory of 2828	2908	loader.exe	43
PID 2828 wrote to memory of 2816	2828	cmd.exe	45
PID 2828 wrote to memory of 2816	2828	cmd.exe	45
PID 2828 wrote to memory of 2816	2828	cmd.exe	45
PID 2908 wrote to memory of 2580	2908	loader.exe	46
PID 2908 wrote to memory of 2580	2908	loader.exe	46
PID 2908 wrote to memory of 2580	2908	loader.exe	46
PID 2580 wrote to memory of 2788	2580	cmd.exe	48
PID 2580 wrote to memory of 2788	2580	cmd.exe	48
PID 2580 wrote to memory of 2788	2580	cmd.exe	48
PID 2908 wrote to memory of 2612	2908	loader.exe	49
PID 2908 wrote to memory of 2612	2908	loader.exe	49
PID 2908 wrote to memory of 2612	2908	loader.exe	49
PID 2612 wrote to memory of 2648	2612	cmd.exe	51
PID 2612 wrote to memory of 2648	2612	cmd.exe	51
PID 2612 wrote to memory of 2648	2612	cmd.exe	51
PID 2908 wrote to memory of 3060	2908	loader.exe	52
PID 2908 wrote to memory of 3060	2908	loader.exe	52
PID 2908 wrote to memory of 3060	2908	loader.exe	52
PID 3060 wrote to memory of 1612	3060	cmd.exe	54
PID 3060 wrote to memory of 1612	3060	cmd.exe	54
PID 3060 wrote to memory of 1612	3060	cmd.exe	54
PID 3060 wrote to memory of 1720	3060	cmd.exe	55
PID 3060 wrote to memory of 1720	3060	cmd.exe	55
PID 3060 wrote to memory of 1720	3060	cmd.exe	55

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\cmd.exe
  /c ipconfig /flushdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:988
- C:\Windows\system32\cmd.exe
  /c netsh interface ip delete arpcache
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete arpcache
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2156
- C:\Windows\system32\cmd.exe
  /c certutil -URLCache * delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\system32\certutil.exe
    certutil -URLCache * delete
    3⤵
    PID:2840
- C:\Windows\system32\cmd.exe
  /c netsh int ip reset
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\system32\netsh.exe
    netsh int ip reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2836
- C:\Windows\system32\cmd.exe
  /c netsh int ipv4 reset
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2816
- C:\Windows\system32\cmd.exe
  /c netsh int ipv6 reset
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\system32\netsh.exe
    netsh int ipv6 reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2788
- C:\Windows\system32\cmd.exe
  /c netsh winsock reset
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\system32\netsh.exe
    netsh winsock reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout /T 1 /NOBREAK > Nul & taskkill /F /IM "loader.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\system32\timeout.exe
    timeout /T 1 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1612
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "loader.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1720

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-17-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1664-20-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1664-19-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1664-18-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2908-6-0x000000013FA30000-0x0000000142E7C000-memory.dmp

Filesize
52.3MB

Download
memory/2908-12-0x0000000076E80000-0x0000000077029000-memory.dmp

Filesize
1.7MB

Download
memory/2908-7-0x000000013FA30000-0x0000000142E7C000-memory.dmp

Filesize
52.3MB

Download
memory/2908-8-0x000000013FA30000-0x0000000142E7C000-memory.dmp

Filesize
52.3MB

Download
memory/2908-1-0x0000000076ED0000-0x0000000076ED2000-memory.dmp

Filesize
8KB

Download
memory/2908-9-0x0000000076E80000-0x0000000077029000-memory.dmp

Filesize
1.7MB

Download
memory/2908-10-0x000000013FA30000-0x0000000142E7C000-memory.dmp

Filesize
52.3MB

Download
memory/2908-5-0x000000013FA30000-0x0000000142E7C000-memory.dmp

Filesize
52.3MB

Download
memory/2908-11-0x000000013FA30000-0x0000000142E7C000-memory.dmp

Filesize
52.3MB

Download
memory/2908-15-0x000000013FA30000-0x0000000142E7C000-memory.dmp

Filesize
52.3MB

Download
memory/2908-16-0x0000000076E80000-0x0000000077029000-memory.dmp

Filesize
1.7MB

Download
memory/2908-3-0x000000013FA30000-0x0000000142E7C000-memory.dmp

Filesize
52.3MB

Download
memory/2908-4-0x000000013FA30000-0x0000000142E7C000-memory.dmp

Filesize
52.3MB

Download
memory/2908-2-0x000000013FA30000-0x0000000142E7C000-memory.dmp

Filesize
52.3MB

Download
memory/2908-0-0x000000013FA30000-0x0000000142E7C000-memory.dmp

Filesize
52.3MB

Download