8e0e38ed2f8c46569c0b1d250f3e66b190d256a7fa0824bd5d3e8bf215fb5ce2

Analysis

max time kernel
166s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rxbaoV3.29_Y/rxbaoV3.29_Y.exe
Size

278KB
MD5

bb38eee96a088ae584ef279ecfa78d23
SHA1

ea6ddd00db17607d6de1d50e64ac27103d7945bf
SHA256

4e6a1b9790bf63d2aa0a9c12d9a9cffc516eb7f793716587786ab37c7f5e89e5
SHA512

7f1e3538e941cae7fb194def0172a9d4cf0dc568024722d70ecb84bf7675c0f281adcdc10c9288b86f4e1b50a5c5c9044f17532f8e89aaac85223b900f783ef5
SSDEEP

6144:uz+92mhAMJ/cPl3im0L4sxZz417txhutOmsLouttmJ1DZc576F17i:uK2mhAMJ/cPl9M4lhutwQ1wU17i

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

热血宝宝自动检测更新.exe

pid process

2152 热血宝宝自动检测更新.exe

pid	process
2152	热血宝宝自动检测更新.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\热血宝宝自动检测更新.exe	upx
C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\热血宝宝自动检测更新.exe	upx
behavioral16/memory/2152-135-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rxbaoV3.29_Y.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	rxbaoV3.29_Y.exe

Drops file in System32 directory 2 IoCs

Processes:

热血宝宝自动检测更新.exe

description	ioc	process
File created	C:\Windows\SysWOW64\zzxxcck.dll	热血宝宝自动检测更新.exe
File opened for modification	C:\Windows\SysWOW64\zzxxcck.dll	热血宝宝自动检测更新.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

热血宝宝自动检测更新.exe

description pid process

Token: SeDebugPrivilege 2152 热血宝宝自动检测更新.exe

description	pid	process
Token: SeDebugPrivilege	2152	热血宝宝自动检测更新.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rxbaoV3.29_Y.exe

description	pid	process	target process
PID 1152 wrote to memory of 2152	1152	rxbaoV3.29_Y.exe	热血宝宝自动检测更新.exe
PID 1152 wrote to memory of 2152	1152	rxbaoV3.29_Y.exe	热血宝宝自动检测更新.exe
PID 1152 wrote to memory of 2152	1152	rxbaoV3.29_Y.exe	热血宝宝自动检测更新.exe

C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\rxbaoV3.29_Y.exe
"C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\rxbaoV3.29_Y.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\热血宝宝自动检测更新.exe
  "C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\热血宝宝自动检测更新.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\热血宝宝自动检测更新.exe

Filesize
37KB

MD5
e9a4f6a3da13323a8b4282df3edd06f5

SHA1
31d785e02734f68b685be1477d240cb56bb06acf

SHA256
3a822cf5a59f18ec26046e2a02d961c17c19c292432587e335dfed4db6b7da27

SHA512
8db04e0dd14bcdcbf2ff8144c64ddfc624db8f23dc5f5386908dabffc5f259b0c33bdc0c17120858666aa828733fdc5326f9eed3e46aaf2dcf3eecf4d4318b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\热血宝宝自动检测更新.exe

Filesize
37KB

MD5
e9a4f6a3da13323a8b4282df3edd06f5

SHA1
31d785e02734f68b685be1477d240cb56bb06acf

SHA256
3a822cf5a59f18ec26046e2a02d961c17c19c292432587e335dfed4db6b7da27

SHA512
8db04e0dd14bcdcbf2ff8144c64ddfc624db8f23dc5f5386908dabffc5f259b0c33bdc0c17120858666aa828733fdc5326f9eed3e46aaf2dcf3eecf4d4318b59

Download Submit
memory/2152-132-0x0000000000000000-mapping.dmp

Download
memory/2152-135-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download