94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b

General

Target

94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b.exe
Size

2.9MB
MD5

a9bc4aeb94664b8938a00b5301225d7a
SHA1

9a0ecb70fc029faeb968de0e639537d6baf525e4
SHA256

94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b
SHA512

3382be368a3d4fc9cf3016dc2bcfc0eb6bf3345ba644441b2e1d8b4f37831216681b5c18e8692c3ea96f1b12df52255dffcc2ab85e5068609cc573b0ff98988c

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
500	Ritroverai.exe.com
4712	Ritroverai.exe.com

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3164	PING.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
500	Ritroverai.exe.com
500	Ritroverai.exe.com
500	Ritroverai.exe.com
4712	Ritroverai.exe.com
4712	Ritroverai.exe.com
4712	Ritroverai.exe.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
500	Ritroverai.exe.com
500	Ritroverai.exe.com
500	Ritroverai.exe.com
4712	Ritroverai.exe.com
4712	Ritroverai.exe.com
4712	Ritroverai.exe.com

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 420 wrote to memory of 1836	420	94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b.exe	69
PID 420 wrote to memory of 1836	420	94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b.exe	69
PID 420 wrote to memory of 1836	420	94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b.exe	69
PID 420 wrote to memory of 4632	420	94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b.exe	71
PID 420 wrote to memory of 4632	420	94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b.exe	71
PID 420 wrote to memory of 4632	420	94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b.exe	71
PID 4632 wrote to memory of 4516	4632	cmd.exe	73
PID 4632 wrote to memory of 4516	4632	cmd.exe	73
PID 4632 wrote to memory of 4516	4632	cmd.exe	73
PID 4516 wrote to memory of 732	4516	cmd.exe	74
PID 4516 wrote to memory of 732	4516	cmd.exe	74
PID 4516 wrote to memory of 732	4516	cmd.exe	74
PID 4516 wrote to memory of 500	4516	cmd.exe	75
PID 4516 wrote to memory of 500	4516	cmd.exe	75
PID 4516 wrote to memory of 500	4516	cmd.exe	75
PID 4516 wrote to memory of 3164	4516	cmd.exe	76
PID 4516 wrote to memory of 3164	4516	cmd.exe	76
PID 4516 wrote to memory of 3164	4516	cmd.exe	76
PID 500 wrote to memory of 4712	500	Ritroverai.exe.com	77
PID 500 wrote to memory of 4712	500	Ritroverai.exe.com	77
PID 500 wrote to memory of 4712	500	Ritroverai.exe.com	77
PID 4712 wrote to memory of 1252	4712	Ritroverai.exe.com	78
PID 4712 wrote to memory of 1252	4712	Ritroverai.exe.com	78
PID 4712 wrote to memory of 1252	4712	Ritroverai.exe.com	78

C:\Users\Admin\AppData\Local\Temp\94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b.exe
"C:\Users\Admin\AppData\Local\Temp\94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:420
- C:\Windows\SysWOW64\expand.exe
  expand
  2⤵
  PID:1836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Confronto.vsd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^zsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDk$" Che.vsd
      4⤵
      PID:732
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.com
      Ritroverai.exe.com B
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:500
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.com B
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4712
      - C:\Windows\SysWOW64\nslookup.exe
        
        C:\Windows\SysWOW64\nslookup.exe
        6⤵
        
        PID:1252
  - - C:\Windows\SysWOW64\PING.EXE
      ping LUCNJVHX
      4⤵
      Runs ping.exe
      PID:3164