Analysis

  • max time kernel
    1797s
  • max time network
    1156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2023, 18:27

General

  • Target

    Arsenic.zip

  • Size

    12.6MB

  • MD5

    d855573af0c6b20d57550bb9402fb0c0

  • SHA1

    5f5c64a1a3656e201e018b8c831d7c8eadada6f7

  • SHA256

    49baf01ac7b25976cc78119c8c9f80f28f5fa45bac6def9f4bdc9793c9b2c960

  • SHA512

    3b3f2a64a811b620c47487652cfbb26dd64b4f6afad593eb2e193e2ad6ff5424ccdbb91179444395d3734661d1b33986474dcfc9de859de5629637c848681933

  • SSDEEP

    393216:rpPwyqbOxaZVo9G5LfbTKg2KYY+IUiXMVZ:rpPSbwaZVo9G5Lv2KCucH

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 1 IoCs
  • Themida packer 15 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Arsenic.zip
    1⤵
      PID:3948
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2872
      • C:\Users\Admin\Desktop\Arsenic\Arsenic.exe
        "C:\Users\Admin\Desktop\Arsenic\Arsenic.exe"
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4564
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1304

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\6c49532e-e21f-4380-bf48-33c3b4686956\Arsenic.dll

              Filesize

              4.2MB

              MD5

              05b012457488a95a05d0541e0470d392

              SHA1

              74f541d6a8365508c794ef7b4ac7c297457f9ce3

              SHA256

              1f77a0749ac730500f203b8c4d072587923ac679e184a3859aeb855c2a2e7d8d

              SHA512

              6d6e7b838d4425d49ac8d3738135374ef5357f0677b07cecb7afbf5feddc1997bf6dce68d48787eff8a74c4728def8880c8f01842eda35b5815fb561fa401ae6

            • C:\Users\Admin\AppData\Local\Temp\6c49532e-e21f-4380-bf48-33c3b4686956\Arsenic.dll

              Filesize

              4.2MB

              MD5

              05b012457488a95a05d0541e0470d392

              SHA1

              74f541d6a8365508c794ef7b4ac7c297457f9ce3

              SHA256

              1f77a0749ac730500f203b8c4d072587923ac679e184a3859aeb855c2a2e7d8d

              SHA512

              6d6e7b838d4425d49ac8d3738135374ef5357f0677b07cecb7afbf5feddc1997bf6dce68d48787eff8a74c4728def8880c8f01842eda35b5815fb561fa401ae6

            • memory/4564-151-0x000001E795330000-0x000001E795340000-memory.dmp

              Filesize

              64KB

            • memory/4564-149-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB

            • memory/4564-142-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB

            • memory/4564-144-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB

            • memory/4564-145-0x00007FF8546B0000-0x00007FF8547FE000-memory.dmp

              Filesize

              1.3MB

            • memory/4564-146-0x000001E7B2EC0000-0x000001E7B2F10000-memory.dmp

              Filesize

              320KB

            • memory/4564-147-0x000001E7B30D0000-0x000001E7B3146000-memory.dmp

              Filesize

              472KB

            • memory/4564-154-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB

            • memory/4564-153-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB

            • memory/4564-150-0x000001E795330000-0x000001E795340000-memory.dmp

              Filesize

              64KB

            • memory/4564-141-0x000001E795330000-0x000001E795340000-memory.dmp

              Filesize

              64KB

            • memory/4564-133-0x000001E794210000-0x000001E794ED8000-memory.dmp

              Filesize

              12.8MB

            • memory/4564-148-0x000001E795330000-0x000001E795340000-memory.dmp

              Filesize

              64KB

            • memory/4564-159-0x000001E795330000-0x000001E795340000-memory.dmp

              Filesize

              64KB

            • memory/4564-161-0x000001E795330000-0x000001E795340000-memory.dmp

              Filesize

              64KB

            • memory/4564-163-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB

            • memory/4564-165-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB

            • memory/4564-166-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB

            • memory/4564-183-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB

            • memory/4564-189-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB

            • memory/4564-193-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB

            • memory/4564-199-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB

            • memory/4564-213-0x00007FF84DAC0000-0x00007FF84E644000-memory.dmp

              Filesize

              11.5MB