6c8dfbba2dfc6053ef6de63a3eb88e980c4f31fdbd249d30d854314a666fff30

Submit
Reports

Overview

overview

Static

static

Themida.exe

windows10-2004-x64

Themida64.exe

windows10-2004-x64

ThemidaHelp.chm

windows10-2004-x64

ThemidaSDK...in.xml

windows10-2004-x64

ThemidaSDK...in.dll

windows10-2004-x64

ThemidaSDK...t1.xml

windows10-2004-x64

ThemidaSDK...ct1.js

windows10-2004-x64

ThemidaSDK...e.html

windows10-2004-x64

ThemidaSDK...le.xml

windows10-2004-x64

ThemidaSDK...10.xml

windows10-2004-x64

ThemidaSDK...llo.js

windows10-2004-x64

ThemidaSDK...t1.xml

windows10-2004-x64

ThemidaSDK...ct1.js

windows10-2004-x64

ThemidaSDK...le.xml

windows10-2004-x64

ThemidaSDK...llo.js

windows10-2004-x64

ThemidaSDK...pt.exe

windows10-2004-x64

ThemidaSDK...on.pdf

windows10-2004-x64

ThemidaSDK...32.dll

windows10-2004-x64

ThemidaSDK...64.dll

windows10-2004-x64

WinlicenseSDK.dll

windows10-2004-x64

demangler.dll

windows10-2004-x64

libspv.dll

windows10-2004-x64

vcomp140.dll

windows10-2004-x64

Analysis

max time kernel
60s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 06:14

Sharing

Copy URL

Twitter E-mail

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Themida.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

9 signatures

60 seconds

Behavioral task

behavioral2

Sample

Themida64.exe

Resource

win10v2004-20230221-en

lumma bootkit evasion persistence stealer trojan

windows10-2004-x64

9 signatures

60 seconds

Behavioral task

behavioral3

Sample

ThemidaHelp.chm

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

60 seconds

Behavioral task

behavioral4

Sample

ThemidaSDK/ExamplesSDK/Plugins/Examples/C/TestPlugin/TestPlugin.xml

Resource

win10v2004-20230220-en

windows10-2004-x64

4 signatures

60 seconds

Behavioral task

behavioral5

Sample

ThemidaSDK/ExamplesSDK/Plugins/Examples/Delphi/TestPlugin.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

2 signatures

60 seconds

Behavioral task

behavioral6

Sample

ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Project1.xml

Resource

win10v2004-20230220-en

windows10-2004-x64

4 signatures

60 seconds

Behavioral task

behavioral7

Sample

ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Project1.js

Resource

win10v2004-20230220-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral8

Sample

ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.html

Resource

win10v2004-20230220-en

windows10-2004-x64

8 signatures

60 seconds

Behavioral task

behavioral9

Sample

ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.xml

Resource

win10v2004-20230220-en

windows10-2004-x64

4 signatures

60 seconds

Behavioral task

behavioral10

Sample

ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.vcproj.7.10.xml

Resource

win10v2004-20230221-en

windows10-2004-x64

4 signatures

60 seconds

Behavioral task

behavioral11

Sample

ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Rust/hello.js

Resource

win10v2004-20230220-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral12

Sample

ThemidaSDK/ExamplesSDK/Protection Macros/C/CBuilder/Project1.xml

Resource

win10v2004-20230220-en

windows10-2004-x64

4 signatures

60 seconds

Behavioral task

behavioral13

Sample

ThemidaSDK/ExamplesSDK/Protection Macros/C/CBuilder/Project1.js

Resource

win10v2004-20230220-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral14

Sample

ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.xml

Resource

win10v2004-20230220-en

windows10-2004-x64

4 signatures

60 seconds

Behavioral task

behavioral15

Sample

ThemidaSDK/ExamplesSDK/Protection Macros/Rust/hello.js

Resource

win10v2004-20230220-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral16

Sample

ThemidaSDK/ExamplesSDK/Protection Macros/Visual Basic/Vb6NoOpt.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

60 seconds

Behavioral task

behavioral17

Sample

ThemidaSDK/Include/C/Via ASM module/How to add ASM files in your Solution.pdf

Resource

win10v2004-20230221-en

windows10-2004-x64

6 signatures

60 seconds

Behavioral task

behavioral18

Sample

ThemidaSDK/SecureEngineSDK32.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

60 seconds

Behavioral task

behavioral19

Sample

ThemidaSDK/SecureEngineSDK64.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

0 signatures

60 seconds

Behavioral task

behavioral20

Sample

WinlicenseSDK.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

2 signatures

60 seconds

Behavioral task

behavioral21

Sample

demangler.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

2 signatures

60 seconds

Behavioral task

behavioral22

Sample

libspv.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

60 seconds

Behavioral task

behavioral23

Sample

vcomp140.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

2 signatures

60 seconds

Report Analysis Logs

General

Target

libspv.dll
Size

868KB
MD5

6c8042af9e749f6406b7bd7dcf98d7eb
SHA1

b7395c27c72eb4b78d8459bb379c613d5f2bb365
SHA256

8338de9a14e5bea902708b00d25c16ec5549639167b96ae162dcdd22f65ec955
SHA512

098a8292a4e35fd21bd4f35c729581dd59e5640b46c2761790864a4f6195c78c7014f33201d2b63ab990cdcb66bc9bbc1b7d76fd46df745e8586e111b159c3ad
SSDEEP

24576:JsB1pU8fkfwILenP0EooIvVXLb40mc4D4RP6vX:Js57kfwVIRW4RP6vX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 4032	3700	rundll32.exe	85
PID 3700 wrote to memory of 4032	3700	rundll32.exe	85
PID 3700 wrote to memory of 4032	3700	rundll32.exe	85

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libspv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libspv.dll,#1
  2⤵
  PID:4032

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads