Overview
overview
9Static
static
9ReasonLabs.rar
windows7-x64
3ReasonLabs.rar
windows10-2004-x64
3ReasonLabs...m.html
windows7-x64
1ReasonLabs...m.html
windows10-2004-x64
1ReasonLabs...47.dll
windows7-x64
3ReasonLabs...47.dll
windows10-2004-x64
1ReasonLabs...eg.dll
windows7-x64
1ReasonLabs...eg.dll
windows10-2004-x64
1ReasonLabs...GL.dll
windows7-x64
1ReasonLabs...GL.dll
windows10-2004-x64
1ReasonLabs...v2.dll
windows7-x64
1ReasonLabs...v2.dll
windows10-2004-x64
3ReasonLabs...app.js
windows7-x64
1ReasonLabs...app.js
windows10-2004-x64
1ReasonLabs...UI.exe
windows7-x64
1ReasonLabs...UI.exe
windows10-2004-x64
1ReasonLabs...er.dll
windows7-x64
3ReasonLabs...er.dll
windows10-2004-x64
3ReasonLabs...alllog
windows7-x64
3ReasonLabs...alllog
windows10-2004-x64
3ReasonLabs...lstate
windows7-x64
3ReasonLabs...lstate
windows10-2004-x64
3ReasonLabs...wf.cat
windows7-x64
8ReasonLabs...wf.cat
windows10-2004-x64
1ReasonLabs...wf.inf
windows7-x64
1ReasonLabs...wf.inf
windows10-2004-x64
1ReasonLabs...config
windows7-x64
3ReasonLabs...config
windows10-2004-x64
3ReasonLabs...p.asar
windows7-x64
3ReasonLabs...p.asar
windows10-2004-x64
3ReasonLabs...ar.sig
windows7-x64
3ReasonLabs...ar.sig
windows10-2004-x64
3Analysis
-
max time kernel
11s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
15-03-2023 23:08
Behavioral task
behavioral1
Sample
ReasonLabs.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ReasonLabs.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
ReasonLabs/Common/Client/v1.0.7/LICENSES.chromium.html
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
ReasonLabs/Common/Client/v1.0.7/LICENSES.chromium.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
ReasonLabs/Common/Client/v1.0.7/d3dcompiler_47.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
ReasonLabs/Common/Client/v1.0.7/d3dcompiler_47.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
ReasonLabs/Common/Client/v1.0.7/ffmpeg.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
ReasonLabs/Common/Client/v1.0.7/ffmpeg.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
ReasonLabs/Common/Client/v1.0.7/libEGL.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
ReasonLabs/Common/Client/v1.0.7/libEGL.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
ReasonLabs/Common/Client/v1.0.7/libGLESv2.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
ReasonLabs/Common/Client/v1.0.7/libGLESv2.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
ReasonLabs/Common/Client/v1.0.7/resources/app.js
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
ReasonLabs/Common/Client/v1.0.7/resources/app.js
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
ReasonLabs/Common/Client/v1.0.7/rsAppUI.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
ReasonLabs/Common/Client/v1.0.7/rsAppUI.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
ReasonLabs/Common/Client/v1.0.7/vk_swiftshader.dll
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
ReasonLabs/Common/Client/v1.0.7/vk_swiftshader.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
ReasonLabs/DNS/rsDNSSvc.installlog
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
ReasonLabs/DNS/rsDNSSvc.installlog
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
ReasonLabs/DNS/rsDNSSvc.installstate
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
ReasonLabs/DNS/rsDNSSvc.installstate
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
ReasonLabs/DNS/rsDwf.cat
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
ReasonLabs/DNS/rsDwf.cat
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
ReasonLabs/DNS/rsDwf.inf
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
ReasonLabs/DNS/rsDwf.inf
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
ReasonLabs/DNS/rsEngine.config
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
ReasonLabs/DNS/rsEngine.config
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
ReasonLabs/DNS/ui/app.asar
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
ReasonLabs/DNS/ui/app.asar
Resource
win10v2004-20230221-en
Behavioral task
behavioral31
Sample
ReasonLabs/DNS/ui/app.asar.sig
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
ReasonLabs/DNS/ui/app.asar.sig
Resource
win10v2004-20230220-en
General
-
Target
ReasonLabs/Common/Client/v1.0.7/d3dcompiler_47.dll
-
Size
4.7MB
-
MD5
bf025b9d99c56903da03c8dc54ee9c5e
-
SHA1
09bd05e4422ea52ba57714a36786d0d65c888bef
-
SHA256
ef370bcb5bd8e6595e2e28136c15dce70d71e49c955a3692df121bbfc82d7ae8
-
SHA512
97e097baebcafaf08f69ab1ee45dcf2872b9ec1d7d9cf53bc9586920f9736c5d9ce4f9abd54aafb308302b3164fcf43e4f5857444ef9060c4835dd4ae0615605
-
SSDEEP
49152:QuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccG:Ay904wYbZCoOI85oyI9
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1712 1280 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1280 wrote to memory of 1712 1280 rundll32.exe WerFault.exe PID 1280 wrote to memory of 1712 1280 rundll32.exe WerFault.exe PID 1280 wrote to memory of 1712 1280 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ReasonLabs\Common\Client\v1.0.7\d3dcompiler_47.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1280 -s 922⤵
- Program crash