Overview

overview

9

Static

static

7

VEprebuild.rar

windows10-2004-x64

7

VEprebuild.rar

windows11-ltsc_2024-x64

1

VEprebuild/Module.dll

windows10-2004-x64

1

VEprebuild/Module.dll

windows11-ltsc_2024-x64

1

VEprebuild/decomp.exe

windows10-2004-x64

1

VEprebuild/decomp.exe

windows11-ltsc_2024-x64

1

VEprebuild/inj.exe

windows10-2004-x64

9

VEprebuild/inj.exe

windows11-ltsc_2024-x64

9

VEprebuild...al.exe

windows10-2004-x64

6

VEprebuild...al.exe

windows11-ltsc_2024-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    VEprebuild.rar
  • Size 13.1MB
  • Sample260808-r7s74aea57
  • SHA256 d695c8838794f8a06d82e3000015cdc68f10261fe35da137ee80b5bde5cd0196
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverythemidatrojan

Malware Config

Targets

    • Target
      VEprebuild.rar
    • Size 13.1MB
    • SHA256 d695c8838794f8a06d82e3000015cdc68f10261fe35da137ee80b5bde5cd0196
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasiondiscoverytrojan

    • Executes dropped EXE

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral1behavioral2
    • Target
      VEprebuild/Module.dll
    • Size 1.8MB
    • SHA256 c60b791e6ab5fe5cb9a01e8708d098d908b370f2a144bd6fa0a44ef695bd01fd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      VEprebuild/decomp.exe
    • Size 3.6MB
    • SHA256 ee3f01b0ec81a6f30dadaaf918a4c9abdd487f23a3781ea1674b37a2aa9d4179
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      VEprebuild/inj.exe
    • Size 3.1MB
    • SHA256 a1e91d18a7a30b9f60bc7d2ba73621bac3efe6af8e15b849ff382569d0027955
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral7behavioral8
    • Target
      VEprebuild/void-external.exe
    • Size 15.6MB
    • SHA256 99d73f635fb2e27b21abbe8b94a79ce40ea884bf4b0d6e8f8122fa921ae89c4e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoverytrojan
    behavioral10behavioral9

MITRE ATT&CK Enterprise v16

Tasks