Analysis
-
max time kernel
18s -
max time network
22s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
10/03/2024, 19:57
General
-
Target
RAT.dll
-
Size
6.5MB
-
MD5
456e3526ad5a6b5a5a47cd6faf3360e2
-
SHA1
6004bb0e362ff64a2995d4682360d9eced6ba14a
-
SHA256
db6f5cb8d4b23fd4b6a63c9bf0078de7e5d56d37d5c3a672a3c35f6e402f0e1d
-
SHA512
9b1e99a293b26936079acf21ee2999fe54626b0b976a0e6e86b1e28a3f728dc0fda04453bbae7653e0250417acda586a41ec79a86da2bf7b67e5bae8b9dd1cd9
-
SSDEEP
196608:/0t2b4JBRP01EbobwDhKqpYSIc1hFD54t5mtMhJHG:I2bmGEMb0hKqeo1hFSbxQ
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\RAT.dll,#11⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16.2MB
-
Filesize
2.0MB
-
Filesize
16.2MB
-
Filesize
16.2MB
-
Filesize
16.2MB
-
Filesize
16.2MB
-
Filesize
16.2MB
-
Filesize
16.2MB
-
Filesize
16.2MB
-
Filesize
16.2MB