1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a

General

Target
1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe
Size 7.4MB
Sample261011-e8q3xady5r
SHA256 1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a
MD5 2896fb26e3d36d050390d22d593b61df
SHA1 a62d625585230b6a4238590195c9aa2a787a79c0
SHA512 080df1897149b0735fc4365b459481bc7ea4416ecee7b9720e0dd678e6558dca2f2f0e62ad40cdfd6e3782e7c17b5cc5ca3ef199c00dd9d4bfedb5fe0657c2f5
SSDEEP 196608:KcRAImlKjMGZLHK9/g1OwyzHv6LNcigd9b+ou92:KcRAImlKjMGZLq9YM7v6C9Lc2
TLSH
T1B5763384F09E47F5D17CADBEC05AAD0EB395E7B1466387CB0A423DB88D81E77B0A4581
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/5272-0-0x0000000140000000-0x0000000140FED000-memory.dmp	themida
behavioral2/memory/5272-1-0x0000000140000000-0x0000000140FED000-memory.dmp	themida
behavioral2/memory/5272-2-0x0000000140000000-0x0000000140FED000-memory.dmp	themida
behavioral2/memory/5272-4-0x0000000140000000-0x0000000140FED000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5272	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe
5272	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\b8461d06517df5112ae84d624b54d6dd3f917515\Blob = 5c0000000100000004000000000100000400000001000000100000005309ddc5f752c54b5c5284fac838d8410f00000001000000200000009a3c026678052ef778b32bb5e2944fdab3961fa7a986e95b8476c350679deea3030000000100000014000000b8461d06517df5112ae84d624b54d6dd3f917515140000000100000014000000b24678fd1cd065062efd74c3c842e75aba26dfdc1900000001000000100000008192fddf815b8fd56e07ba042017668720000000010000000902000030820205308201aca00302010202147dc255c0965d2105b448a12068d594ca15348085300a06082a8648ce3d0403023061310b3009060355040613025553311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e3132303006035504030c294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3236303931343039343533385a170d3436303930393039343533385a3061310b3009060355040613025553311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e3132303006035504030c294d6963726f736f667420526f6f7420436572746966696361746520417574686f7269747920323031303059301306072a8648ce3d020106082a8648ce3d0301070342000423b1f8c3b3806e30178c509f7513d9832de06c1c34e4d546133c3559571595efa42dd68c4d4106cb720795bcbc8f33a9f30714844efdd15b2265e1950b9189a6a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414b24678fd1cd065062efd74c3c842e75aba26dfdc300a06082a8648ce3d040302034700304402201869108ca3ddf810add9c830475b9773d38764589c1c7993f4de6e6326133f3102206bc4b35ccee24d0079a7b5a252492cb5f43c246d652c3bb312a6f93df5a578fc	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\b8461d06517df5112ae84d624b54d6dd3f917515\Blob = 6b00000001000000200000001d025be6f911be5471b5e9443667778327b9573d0bc61ad3f989ca5ddae3cf3c1900000001000000100000008192fddf815b8fd56e07ba0420176687140000000100000014000000b24678fd1cd065062efd74c3c842e75aba26dfdc030000000100000014000000b8461d06517df5112ae84d624b54d6dd3f9175150f00000001000000200000009a3c026678052ef778b32bb5e2944fdab3961fa7a986e95b8476c350679deea30400000001000000100000005309ddc5f752c54b5c5284fac838d8415c00000001000000040000000001000020000000010000000902000030820205308201aca00302010202147dc255c0965d2105b448a12068d594ca15348085300a06082a8648ce3d0403023061310b3009060355040613025553311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e3132303006035504030c294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3236303931343039343533385a170d3436303930393039343533385a3061310b3009060355040613025553311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e3132303006035504030c294d6963726f736f667420526f6f7420436572746966696361746520417574686f7269747920323031303059301306072a8648ce3d020106082a8648ce3d0301070342000423b1f8c3b3806e30178c509f7513d9832de06c1c34e4d546133c3559571595efa42dd68c4d4106cb720795bcbc8f33a9f30714844efdd15b2265e1950b9189a6a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414b24678fd1cd065062efd74c3c842e75aba26dfdc300a06082a8648ce3d040302034700304402201869108ca3ddf810add9c830475b9773d38764589c1c7993f4de6e6326133f3102206bc4b35ccee24d0079a7b5a252492cb5f43c246d652c3bb312a6f93df5a578fc	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\b8461d06517df5112ae84d624b54d6dd3f917515	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B8461D06517DF5112AE84D624B54D6DD3F917515	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5272	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe
5272	1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe

C:\Users\Admin\AppData\Local\Temp\1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe
"C:\Users\Admin\AppData\Local\Temp\1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:5272