Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-12-2021 23:56
Static task
static1
Behavioral task
behavioral1
Sample
RT.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
RT.msi
-
Size
2.2MB
-
MD5
55b75999aeba3ccfd5309b39d7880baa
-
SHA1
293a2c7cd6ab5851563d868d549e9a2dfd00842c
-
SHA256
e07e5f0295deb4c8a77519cf41d915046d6962db92b7e667f68267d30e0b8399
-
SHA512
59a8bad2040260f13ec4171e5ce6f28b04b1d6705aed4d7c9a9270c472062095bd4ec8cdc38fe962a55b8f8bc0b8f5afc4565d99f3dffee87dc12b107f9fd76f
Malware Config
Signatures
-
Detect Numando Payload 4 IoCs
resource yara_rule behavioral2/files/0x000600000001ab3a-144.dat family_numando behavioral2/files/0x000600000001ab3a-146.dat family_numando behavioral2/files/0x000600000001ab3a-145.dat family_numando behavioral2/memory/424-147-0x0000000000B80000-0x000000000148F000-memory.dmp family_numando -
Blocklisted process makes network request 5 IoCs
flow pid Process 16 3404 MsiExec.exe 18 3404 MsiExec.exe 20 3404 MsiExec.exe 22 3404 MsiExec.exe 24 3404 MsiExec.exe -
Executes dropped EXE 2 IoCs
pid Process 4520 MSIDAFC.tmp 424 Object.exe -
Loads dropped DLL 13 IoCs
pid Process 3404 MsiExec.exe 3404 MsiExec.exe 3404 MsiExec.exe 3404 MsiExec.exe 3404 MsiExec.exe 3404 MsiExec.exe 3404 MsiExec.exe 3404 MsiExec.exe 3404 MsiExec.exe 424 Object.exe 424 Object.exe 424 Object.exe 424 Object.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Object.exe = "C:\\Users\\Admin\\AppData\\Roaming\\WEFHWE0-FWEUY-F9WUEFWWEF\\BND0WEPWEJFC-9UEWFF\\Object.exe" Object.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f75ae04.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC3A4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBFEA.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{C5886386-F26F-4C16-A501-438E40C8CBDA} msiexec.exe File opened for modification C:\Windows\Installer\MSIC3F3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC54E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID973.tmp msiexec.exe File created C:\Windows\Installer\f75ae04.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIBB92.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBC30.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC461.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAEEE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBAC6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDAFC.tmp msiexec.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "46" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "9" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "844" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "27" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "89" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "46" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "74" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "74" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "844" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "27" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "46" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "844" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "9" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "89" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "74" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "89" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFC2F79E-59B0-11EC-876A-4A7FAB6426E3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DOMStorage\websetnet.net\Total = "27" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4176 msiexec.exe 4176 msiexec.exe 424 Object.exe 424 Object.exe 424 Object.exe 424 Object.exe 424 Object.exe 424 Object.exe 424 Object.exe 424 Object.exe -
Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeShutdownPrivilege 3648 msiexec.exe Token: SeIncreaseQuotaPrivilege 3648 msiexec.exe Token: SeSecurityPrivilege 4176 msiexec.exe Token: SeCreateTokenPrivilege 3648 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3648 msiexec.exe Token: SeLockMemoryPrivilege 3648 msiexec.exe Token: SeIncreaseQuotaPrivilege 3648 msiexec.exe Token: SeMachineAccountPrivilege 3648 msiexec.exe Token: SeTcbPrivilege 3648 msiexec.exe Token: SeSecurityPrivilege 3648 msiexec.exe Token: SeTakeOwnershipPrivilege 3648 msiexec.exe Token: SeLoadDriverPrivilege 3648 msiexec.exe Token: SeSystemProfilePrivilege 3648 msiexec.exe Token: SeSystemtimePrivilege 3648 msiexec.exe Token: SeProfSingleProcessPrivilege 3648 msiexec.exe Token: SeIncBasePriorityPrivilege 3648 msiexec.exe Token: SeCreatePagefilePrivilege 3648 msiexec.exe Token: SeCreatePermanentPrivilege 3648 msiexec.exe Token: SeBackupPrivilege 3648 msiexec.exe Token: SeRestorePrivilege 3648 msiexec.exe Token: SeShutdownPrivilege 3648 msiexec.exe Token: SeDebugPrivilege 3648 msiexec.exe Token: SeAuditPrivilege 3648 msiexec.exe Token: SeSystemEnvironmentPrivilege 3648 msiexec.exe Token: SeChangeNotifyPrivilege 3648 msiexec.exe Token: SeRemoteShutdownPrivilege 3648 msiexec.exe Token: SeUndockPrivilege 3648 msiexec.exe Token: SeSyncAgentPrivilege 3648 msiexec.exe Token: SeEnableDelegationPrivilege 3648 msiexec.exe Token: SeManageVolumePrivilege 3648 msiexec.exe Token: SeImpersonatePrivilege 3648 msiexec.exe Token: SeCreateGlobalPrivilege 3648 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe Token: SeRestorePrivilege 4176 msiexec.exe Token: SeTakeOwnershipPrivilege 4176 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3648 msiexec.exe 3648 msiexec.exe 1760 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1760 iexplore.exe 1760 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4176 wrote to memory of 3404 4176 msiexec.exe 71 PID 4176 wrote to memory of 3404 4176 msiexec.exe 71 PID 4176 wrote to memory of 3404 4176 msiexec.exe 71 PID 4176 wrote to memory of 4520 4176 msiexec.exe 73 PID 4176 wrote to memory of 4520 4176 msiexec.exe 73 PID 4176 wrote to memory of 4520 4176 msiexec.exe 73 PID 424 wrote to memory of 1760 424 Object.exe 75 PID 424 wrote to memory of 1760 424 Object.exe 75 PID 1760 wrote to memory of 2804 1760 iexplore.exe 76 PID 1760 wrote to memory of 2804 1760 iexplore.exe 76 PID 1760 wrote to memory of 2804 1760 iexplore.exe 76
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RT.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3648
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B928FDB3BAB3AD6A816CC4BEE9AC34D52⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3404
-
-
C:\Windows\Installer\MSIDAFC.tmp"C:\Windows\Installer\MSIDAFC.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\WEFHWE0-FWEUY-F9WUEFWWEF\BND0WEPWEJFC-9UEWFF\Object.exe"2⤵
- Executes dropped EXE
PID:4520
-
-
C:\Users\Admin\AppData\Roaming\WEFHWE0-FWEUY-F9WUEFWWEF\BND0WEPWEJFC-9UEWFF\Object.exe"C:\Users\Admin\AppData\Roaming\WEFHWE0-FWEUY-F9WUEFWWEF\BND0WEPWEJFC-9UEWFF\Object.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" %1 "https://bit.ly/3DvoVCc"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:82945 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
-