Resubmissions
30/09/2022, 10:35
220930-mm59psebhl 629/09/2022, 13:01
220929-p9fcxaahd8 617/12/2021, 18:47
211217-xfnq7aegfp 1016/12/2021, 14:14
211216-rj2vbsccc8 1016/12/2021, 14:07
211216-re4s5achhj 10Analysis
-
max time kernel
56s -
max time network
56s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
30/09/2022, 10:35
Static task
static1
Behavioral task
behavioral1
Sample
RL.exe
Resource
win10-20220812-en
windows10-1703-x64
9 signatures
150 seconds
General
-
Target
RL.exe
-
Size
333KB
-
MD5
981f7a4bb2592bffcbdf543a742cb1a2
-
SHA1
64d97d061583e343ce7a02a4b905281d95ff0bba
-
SHA256
4e64776e3c8b0f6e432fb300b8f7d95b10d1a8ec223d15e1462d64cdde555c50
-
SHA512
b0be15a1d8a80506de3b615f1c5713a9acaf46b9577187f6c1dbfa6539b0641ebc4c83178a3c4bed2342d5e8bea4c910b30853d1e91b87b824d4f9173b46397b
-
SSDEEP
6144:Jk2RY4ljn2ESxRTIoWD4BXHOfCzP+52iC3WfiNaw1QDSLk/3U:Jk2RYi6TIoWMZ4GWf19/k
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2888 2752 WerFault.exe 65 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4344 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2752 RL.exe Token: SeDebugPrivilege 4344 taskmgr.exe Token: SeSystemProfilePrivilege 4344 taskmgr.exe Token: SeCreateGlobalPrivilege 4344 taskmgr.exe -
Suspicious use of FindShellTrayWindow 62 IoCs
pid Process 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe -
Suspicious use of SendNotifyMessage 61 IoCs
pid Process 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RL.exe"C:\Users\Admin\AppData\Local\Temp\RL.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2752 -s 15362⤵
- Program crash
PID:2888
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4344