Overview

overview

9

Static

static

7

hanzowoofe...er.exe

windows11-21h2-x64

9

x64/Beamer x64.exe

windows11-21h2-x64

1

x64/Device...er.dll

windows11-21h2-x64

1

x64/GleeBu...ne.dll

windows11-21h2-x64

1

x64/LLVMDemangle.dll

windows11-21h2-x64

1

x64/Qt5Core.dll

windows11-21h2-x64

1

x64/Qt5Gui.dll

windows11-21h2-x64

1

x64/Qt5Network.dll

windows11-21h2-x64

1

x64/Qt5Svg.dll

windows11-21h2-x64

1

x64/Qt5Widgets.dll

windows11-21h2-x64

1

x64/Qt5WinExtras.dll

windows11-21h2-x64

1

x64/Scylla.dll

windows11-21h2-x64

1

x64/Static...ne.dll

windows11-21h2-x64

1

x64/TitanEngine.dll

windows11-21h2-x64

1

x64/XEDParse.dll

windows11-21h2-x64

1

x64/asmjit.dll

windows11-21h2-x64

1

x64/dbghelp.dll

windows11-21h2-x64

1

x64/iconen...on.dll

windows11-21h2-x64

1

x64/imagef...if.dll

windows11-21h2-x64

1

x64/imagef...ns.dll

windows11-21h2-x64

1

x64/imagef...co.dll

windows11-21h2-x64

1

x64/imagef...eg.dll

windows11-21h2-x64

1

x64/imagef...vg.dll

windows11-21h2-x64

1

x64/imagef...ga.dll

windows11-21h2-x64

1

x64/imagef...ff.dll

windows11-21h2-x64

1

x64/imagef...mp.dll

windows11-21h2-x64

1

x64/imagef...bp.dll

windows11-21h2-x64

1

x64/jansson.dll

windows11-21h2-x64

1

x64/ldconvert.dll

windows11-21h2-x64

1

x64/libeay32.dll

windows11-21h2-x64

1

x64/loaddll.exe

windows11-21h2-x64

1

x64/lz4.dll

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    hanzowoofercracked.rar
  • Size 44.1MB
  • Sample261024-1swt4sfh52
  • SHA256 1dd88bd12922e9d756d52f66d8c1198ed8c7cf0477c35990f5ee738246c0ef0a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecutionthemidatrojan

Malware Config

Targets

    • Target
      hanzowoofercracked/hanzopermspoofer.exe
    • Size 31.0MB
    • SHA256 283a8086913fe4355ff9b17d5a0037563f078b09eb4b3b50952a9192a2e974ff
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasionexecutionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Stops running service(s)

      defense_evasionexecution

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

      defense_evasion
    behavioral1
    • Target
      x64/Beamer x64.exe
    • Size 59KB
    • SHA256 30331e2bb723d497376036b467960b3435f0c625247740856123e35f33c8457f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2
    • Target
      x64/DeviceNameResolver.dll
    • Size 70KB
    • SHA256 b63354cf2bc3b7ffb5b679f78af7993d094561fd307f6ebc2a30c4db69f5b79d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      x64/GleeBug/TitanEngine.dll
    • Size 508KB
    • SHA256 0d2f0b369218e86f4ee8ae7f03295a01e3724d0b9e1393309c8dc02b279b6e3a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4
    • Target
      x64/LLVMDemangle.dll
    • Size 593KB
    • SHA256 8de391f11ceeafa007badf71b62560368f8c71623486ff1c2e4c5373fe482834
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5
    • Target
      x64/Qt5Core.dll
    • Size 5.3MB
    • SHA256 7a4cb4ced60598ed0a4f31dfdc01a8019df5cca6cbbfd3ec7f629edd99db6007
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      x64/Qt5Gui.dll
    • Size 5.7MB
    • SHA256 3506bd2e291fe85a675d268e705f46dd0da7c274ec43dcb2330b8cee2b8c1d24
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7
    • Target
      x64/Qt5Network.dll
    • Size 1.0MB
    • SHA256 4708ed9604e731f3b7b9b1fd774f3962a80bdf36a1845a3bb7684e8507eb0be0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8
    • Target
      x64/Qt5Svg.dll
    • Size 312KB
    • SHA256 78a031f1a8254e20c3e63357a2a87f8f6f2ba807e8edd74df6c2539b019ec309
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      x64/Qt5Widgets.dll
    • Size 5.3MB
    • SHA256 6fbc262e506dc957dfdf72852cfc3b2c8b7850ec5eef4dc30f9fc9e066a8b911
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      x64/Qt5WinExtras.dll
    • Size 284KB
    • SHA256 8dc1c6ad37a164639ef75093d8a0179f6f8efdf1a22877c59bac745968738e6d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11
    • Target
      x64/Scylla.dll
    • Size 535KB
    • SHA256 f0c2702ebc37ba355c9db71b810c6228b5d62369cb2fdf47bdff8f6b03a1a964
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12
    • Target
      x64/StaticEngine/TitanEngine.dll
    • Size 148KB
    • SHA256 97562ae24c1e05a10bffee17d42380e041c6c1e7a6745bcdc6c1c694471975e8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13
    • Target
      x64/TitanEngine.dll
    • Size 626KB
    • SHA256 6a82dc49f8bd5c30fd368c2c9616588ca68cfd6f0dd8bba526c927bfbd4ded90
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral14
    • Target
      x64/XEDParse.dll
    • Size 1.4MB
    • SHA256 1d339e41ca9d5337b410feec1ca808a7ad8b0af2cb6827cfe581cacbe04ba376
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15
    • Target
      x64/asmjit.dll
    • Size 248KB
    • SHA256 746603fa6ed86d3e3885b2bd5c79692b6ba8429bf95961f4dda3da4749fb13cf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral16
    • Target
      x64/dbghelp.dll
    • Size 1.4MB
    • SHA256 507262cb88b8ebc64a79451c49cd3b59eab97f4b81d265b51d6ccba487ba8301
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17
    • Target
      x64/iconengines/qsvgicon.dll
    • Size 45KB
    • SHA256 b84e5e02ef6e91848a0d8033965325a988981077ca18edf9abaacc391a128a84
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral18
    • Target
      x64/imageformats/qgif.dll
    • Size 38KB
    • SHA256 c2fce71c35bd6e22e2ea3a7e0554fe9a726f55d7027bcdbe587fab8983c3e421
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19
    • Target
      x64/imageformats/qicns.dll
    • Size 45KB
    • SHA256 0a0f36c046fff544e335a0d0d80a2c36ac6064f474793426172899fe85d3e91d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral20
    • Target
      x64/imageformats/qico.dll
    • Size 39KB
    • SHA256 98aa16bc5192ec26ba1ba6b290acd984d50732a91e563eaa1016bcf923643f7e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21
    • Target
      x64/imageformats/qjpeg.dll
    • Size 240KB
    • SHA256 1a0d4ded8487a727b27dff67ef2f3794d40e1bab2e4d42b8250cc1e8525f5faa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral22
    • Target
      x64/imageformats/qsvg.dll
    • Size 32KB
    • SHA256 0548ef18dec7ee2d6d2ff51cd0e78136f9f6002fa389158df2ac841425201ec5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23
    • Target
      x64/imageformats/qtga.dll
    • Size 31KB
    • SHA256 37d36178f5c4e0bc546e05951c4da799ca21fa82690c0fdef1f1761703fd1b66
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral24
    • Target
      x64/imageformats/qtiff.dll
    • Size 355KB
    • SHA256 b9a79722472ffaa7a8e3025254fcd053ee1193ffd59353d8e9f28de99ffe7ed4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25
    • Target
      x64/imageformats/qwbmp.dll
    • Size 30KB
    • SHA256 3ffa4adc5b5d9aab693f845f53b99774b7daec78c1aefc525b07bf794ac596c7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral26
    • Target
      x64/imageformats/qwebp.dll
    • Size 376KB
    • SHA256 5a9beec614fa7195a568d82f3f892092832f15bc3240a7805f33b54b21a68cd2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27
    • Target
      x64/jansson.dll
    • Size 142KB
    • SHA256 f8302919d3152b64ae0111b2ddcb4b21e63b674d10e203c05c2a7af015ba6710
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral28
    • Target
      x64/ldconvert.dll
    • Size 56KB
    • SHA256 293539875b478fc2b554104f8c1e0e80a169e75c829a5b882e10b601e6e99744
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29
    • Target
      x64/libeay32.dll
    • Size 2.2MB
    • SHA256 19396b3fd3458ace580054156b2f257f1687907427def44321f5e989aef4b14a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral30
    • Target
      x64/loaddll.exe
    • Size 88KB
    • SHA256 63d0732dcb7b6babd53de59cec01cbba6da148a610dea65d3e758b6fced138b3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31
    • Target
      x64/lz4.dll
    • Size 91KB
    • SHA256 97262ec9688ba204c97fba061bc95b24c2cd67b8839d43217024a542e9d8f124
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

themida
Score
7/10

behavioral1

defense_evasionexecutionthemidatrojan
Score
9/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10