Resubmissions
11-08-2024 19:58
240811-ypwc3azbkb 9Analysis
-
max time kernel
142s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11-08-2024 19:58
General
-
Target
SolaraV3.dll
-
Size
6.4MB
-
MD5
00d1ec7ef2ab88125ce0bd43a3f62d33
-
SHA1
fde302f1421b94ae4b9e3aaa4cd4d65bcda40789
-
SHA256
7953e72cb972278e947c83c6a8bdcba35c7f2225566dd1b4fff686077cace832
-
SHA512
f56086204dc52a44ab35906a2c55dfe3d2418f8034e51664bcdefe44dd7b16a39d8f87dc0650f6e7e5f9d69ef88e1d4826bf2050cc69ecefd01d9bb958b4e8c6
-
SSDEEP
196608:SGMIUWMIaAKFHsairmB8tm/+YTN5uyezSnC+v3uBg:TRd4qairmBy0+eQyWR+vgg
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SolaraV3.dll,#11⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Blocklisted process makes network request
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB