Overview

overview

9

Static

static

7

Loader.exe

windows7-x64

9

Loader.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    46s
  • max time network
    56s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-06-2024 18:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Loader.exe

  • Size

    16.8MB

  • MD5

    0107075cd4f1ba34b951c895eacc1285

  • SHA1

    f50404806a62dc04ab129397e30a9cb1d2dbc8db

  • SHA256

    b6977ad0b0332d1466e0843ebef2decc3e2fcc01f8fc62da2d3f2e716a63dc81

  • SHA512

    0ededb1af828e7fd85b3fa38f5f17ba21222c6e0da5a1f46f5328acd379aca9153d9dd5c9da904d1a834d2b5baac2e12017aaa023d93f5b3bf312f19e1540915

  • SSDEEP

    393216:muBhAp43/nfPmZXtCshmXQ3KIpoOwkwbyco/76hikE1cpPFLc5:FspnJh13Zcm76+MPZE

Score
9/10
evasionexecutionpersistencethemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Drops file in Drivers directory 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Drops file in Drivers directory
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4120
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:60
      • C:\Windows\system32\sc.exe
        sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
        3⤵
        • Launches sc.exe
        PID:4748
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C sc start windowsproc
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Windows\system32\sc.exe
        sc start windowsproc
        3⤵
        • Launches sc.exe
        PID:1000
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:348
      • C:\Windows\system32\sc.exe
        sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
        3⤵
        • Launches sc.exe
        PID:1948
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C sc start windowsproc
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4132
      • C:\Windows\system32\sc.exe
        sc start windowsproc
        3⤵
        • Launches sc.exe
        PID:3048
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:4024

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    System Services

    1
    T1569

    Service Execution

    1
    T1569.002

    Persistence

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Privilege Escalation

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Defense Evasion

    Virtualization/Sandbox Evasion

    1
    T1497

    Credential Access

    Discovery

    Query Registry

    3
    T1012

    Virtualization/Sandbox Evasion

    1
    T1497

    System Information Discovery

    4
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4120-1-0x00007FF965530000-0x00007FF965532000-memory.dmp
      Filesize

      8KB

      Download
    • memory/4120-0-0x0000000140000000-0x00000001425F1000-memory.dmp
      Filesize

      37.9MB

      Download
    • memory/4120-2-0x0000000140000000-0x00000001425F1000-memory.dmp
      Filesize

      37.9MB

      Download
    • memory/4120-3-0x0000000140000000-0x00000001425F1000-memory.dmp
      Filesize

      37.9MB

      Download
    • memory/4120-4-0x0000000140000000-0x00000001425F1000-memory.dmp
      Filesize

      37.9MB

      Download
    • memory/4120-5-0x0000000140000000-0x00000001425F1000-memory.dmp
      Filesize

      37.9MB

      Download
    • memory/4120-9-0x0000000140000000-0x00000001425F1000-memory.dmp
      Filesize

      37.9MB

      Download
    • memory/4120-11-0x0000000140000000-0x00000001425F1000-memory.dmp
      Filesize

      37.9MB

      Download