Analysis

  • max time kernel
    1791s
  • max time network
    1716s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-06-2024 07:29

General

  • Target

    packet????????/PacketV3.dll

  • Size

    6.8MB

  • MD5

    85c9c29093b3097df94a680a8345e631

  • SHA1

    9d45177aa70eb3c18c4a1896335533e86618d7d6

  • SHA256

    bc0fd649456fb61a9b11c1194ce3398254344e1e26f586b1f910cdd1ebd98d51

  • SHA512

    5293de3a7d4f5a373b8dc4f9ce64ce259f21e5d72b7e8020a8345f1956091ec3d2a0767ab3477764a7924e0f9ad1261bf8f113015535acfe4468d666a7febd97

  • SSDEEP

    196608:i/xDxfntmQr7VvNhyo6n7DxkzKdC7rGLqwahBKhnwvtMg:i5t/Xr7VvNen29uMhBwn4ig

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 9 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\packet________\PacketV3.dll,#1
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1904-0-0x00007FF8B0CB0000-0x00007FF8B1D18000-memory.dmp
    Filesize

    16.4MB

  • memory/1904-1-0x00007FF8CF390000-0x00007FF8CF392000-memory.dmp
    Filesize

    8KB

  • memory/1904-2-0x00007FF8B0CB0000-0x00007FF8B1D18000-memory.dmp
    Filesize

    16.4MB

  • memory/1904-3-0x00007FF8B0CB0000-0x00007FF8B1D18000-memory.dmp
    Filesize

    16.4MB

  • memory/1904-4-0x00007FF8B0CB0000-0x00007FF8B1D18000-memory.dmp
    Filesize

    16.4MB

  • memory/1904-5-0x00007FF8B0CB0000-0x00007FF8B1D18000-memory.dmp
    Filesize

    16.4MB

  • memory/1904-6-0x00007FF8B0CB0000-0x00007FF8B1D18000-memory.dmp
    Filesize

    16.4MB

  • memory/1904-7-0x00007FF8B0CB0000-0x00007FF8B1D18000-memory.dmp
    Filesize

    16.4MB

  • memory/1904-8-0x00007FF8B0CB0000-0x00007FF8B1D18000-memory.dmp
    Filesize

    16.4MB

  • memory/1904-9-0x00007FF8B0CB0000-0x00007FF8B1D18000-memory.dmp
    Filesize

    16.4MB