94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b

General

Target

a9bc4aeb94664b8938a00b5301225d7a.exe
Size

2.9MB
MD5

a9bc4aeb94664b8938a00b5301225d7a
SHA1

9a0ecb70fc029faeb968de0e639537d6baf525e4
SHA256

94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b
SHA512

3382be368a3d4fc9cf3016dc2bcfc0eb6bf3345ba644441b2e1d8b4f37831216681b5c18e8692c3ea96f1b12df52255dffcc2ab85e5068609cc573b0ff98988c

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1348	Ritroverai.exe.com
652	Ritroverai.exe.com

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a9bc4aeb94664b8938a00b5301225d7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a9bc4aeb94664b8938a00b5301225d7a.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
868	PING.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1348	Ritroverai.exe.com
1348	Ritroverai.exe.com
1348	Ritroverai.exe.com
652	Ritroverai.exe.com
652	Ritroverai.exe.com
652	Ritroverai.exe.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1348	Ritroverai.exe.com
1348	Ritroverai.exe.com
1348	Ritroverai.exe.com
652	Ritroverai.exe.com
652	Ritroverai.exe.com
652	Ritroverai.exe.com

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3756	2752	a9bc4aeb94664b8938a00b5301225d7a.exe	68
PID 2752 wrote to memory of 3756	2752	a9bc4aeb94664b8938a00b5301225d7a.exe	68
PID 2752 wrote to memory of 3756	2752	a9bc4aeb94664b8938a00b5301225d7a.exe	68
PID 2752 wrote to memory of 2548	2752	a9bc4aeb94664b8938a00b5301225d7a.exe	70
PID 2752 wrote to memory of 2548	2752	a9bc4aeb94664b8938a00b5301225d7a.exe	70
PID 2752 wrote to memory of 2548	2752	a9bc4aeb94664b8938a00b5301225d7a.exe	70
PID 2548 wrote to memory of 3944	2548	cmd.exe	72
PID 2548 wrote to memory of 3944	2548	cmd.exe	72
PID 2548 wrote to memory of 3944	2548	cmd.exe	72
PID 3944 wrote to memory of 2660	3944	cmd.exe	73
PID 3944 wrote to memory of 2660	3944	cmd.exe	73
PID 3944 wrote to memory of 2660	3944	cmd.exe	73
PID 3944 wrote to memory of 1348	3944	cmd.exe	74
PID 3944 wrote to memory of 1348	3944	cmd.exe	74
PID 3944 wrote to memory of 1348	3944	cmd.exe	74
PID 3944 wrote to memory of 868	3944	cmd.exe	75
PID 3944 wrote to memory of 868	3944	cmd.exe	75
PID 3944 wrote to memory of 868	3944	cmd.exe	75
PID 1348 wrote to memory of 652	1348	Ritroverai.exe.com	76
PID 1348 wrote to memory of 652	1348	Ritroverai.exe.com	76
PID 1348 wrote to memory of 652	1348	Ritroverai.exe.com	76
PID 652 wrote to memory of 1188	652	Ritroverai.exe.com	78
PID 652 wrote to memory of 1188	652	Ritroverai.exe.com	78
PID 652 wrote to memory of 1188	652	Ritroverai.exe.com	78

C:\Users\Admin\AppData\Local\Temp\a9bc4aeb94664b8938a00b5301225d7a.exe
"C:\Users\Admin\AppData\Local\Temp\a9bc4aeb94664b8938a00b5301225d7a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\expand.exe
  expand
  2⤵
  PID:3756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Confronto.vsd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^zsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDk$" Che.vsd
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.com
      Ritroverai.exe.com B
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.com B
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:652
      - C:\Windows\SysWOW64\nslookup.exe
        
        C:\Windows\SysWOW64\nslookup.exe
        6⤵
        
        PID:1188
  - - C:\Windows\SysWOW64\PING.EXE
      ping JQKTJDNJ
      4⤵
      Runs ping.exe
      PID:868