Analysis
-
max time kernel
93s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
23/12/2023, 01:18
General
-
Target
Prax.dll
-
Size
5.4MB
-
MD5
ad6bf6c37d545b51df1ae3670f911020
-
SHA1
fc32a802c09a4d91257edaf993f5d0f65d368d04
-
SHA256
6b03618ea53f12d9ce51476599362e5f503b3a020f22b80dd2ad7d1be4b5add5
-
SHA512
a90e08e457aaebd68915627c8aae5ad4e2626f712cc10578cd3ffd97e358c98ad36f8226068bf0343e1b5d9bdb2dda52d52bb526827d63671836569d626a7adb
-
SSDEEP
98304:Ro+ZRKELs7IM7RnLYQQaLZBKSFE0aypzLUbfkKLjowtgPrILFfrN1mwb:9KYWIARnkQQaPKSFE05JUbsKvNe4D6wb
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Blocklisted process makes network request 2 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 8 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Prax.dll,#11⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Blocklisted process makes network request
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.9MB
-
Filesize
2.0MB
-
Filesize
13.9MB
-
Filesize
13.9MB
-
Filesize
13.9MB
-
Filesize
13.9MB
-
Filesize
13.9MB
-
Filesize
13.9MB
-
Filesize
13.9MB
-
Filesize
2.0MB