Overview

overview

10

Static

static

10

sample/AMD.exe

windows11-21h2-x64

1

sample/AppHost.exe

windows11-21h2-x64

1

sample/AppModule.exe

windows11-21h2-x64

1

sample/Mic...st.exe

windows11-21h2-x64

1

sample/WildHost.exe

windows11-21h2-x64

1

sample/Win...64.sys

windows11-21h2-x64

1

sample/audiodg.exe

windows11-21h2-x64

9

sample/winlogon.bat

windows11-21h2-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    Malwary_sample.rar
  • Size 159.1MB
  • Sample260708-1ppavsav4w
  • SHA256 219c45295b0cda890a509f4639ce25285aeb30b3bba4ccf02833e3ac78574601
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xmrigdefense_evasionexecutionminerthemidatrojan

Malware Config

Targets

    • Target
      sample/AMD.exe
    • Size 71.1MB
    • SHA256 7411902ba3632eb8c449486f61ee1b556520aca7f3ae5229d81d6b263c733fcb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1
    • Target
      sample/AppHost.exe
    • Size 303KB
    • SHA256 b4e264dc7bf4ed7807d8e09e67f5cb6ea887ab016458859de7821106081d6eef
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2
    • Target
      sample/AppModule.exe
    • Size 71.1MB
    • SHA256 7411902ba3632eb8c449486f61ee1b556520aca7f3ae5229d81d6b263c733fcb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      sample/MicrosoftHost.exe
    • Size 5.4MB
    • SHA256 12a209356db82dc1fc47da0a9a146096f6a9e7cd99e2ec71d513f394b57fc5f8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4
    • Target
      sample/WildHost.exe
    • Size 25.1MB
    • SHA256 227fd031baaff8b5bcb6a2c7283f7cd293baa3d3a36ae15f0413b2cf16d61113
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5
    • Target
      sample/WinRing0x64.sys
    • Size 14KB
    • SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      sample/audiodg.exe
    • Size 6.0MB
    • SHA256 5a497db8cbf707ba0c5eae9d92327af234421fff7a8075115f140d4da1d6b8a7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral7
    • Target
      sample/winlogon.bat
    • Size 134B
    • SHA256 39128f3f6e8910fc7766da7eb80e5bea6b1c32cbd47ac6d1c7b60ee11d088ba9
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral8

MITRE ATT&CK Enterprise v16

Tasks