Overview
overview
10Static
static
7trojan-lea...V).exe
windows7-x64
10trojan-lea...V).exe
windows10-2004-x64
10trojan-lea...23.exe
windows7-x64
1trojan-lea...23.exe
windows10-2004-x64
1trojan-lea...ue.exe
windows7-x64
1trojan-lea...ue.exe
windows10-2004-x64
1trojan-lea...v2.exe
windows7-x64
1trojan-lea...v2.exe
windows10-2004-x64
1trojan-lea...rg.exe
windows7-x64
1trojan-lea...rg.exe
windows10-2004-x64
1trojan-lea...rd.exe
windows7-x64
7trojan-lea...rd.exe
windows10-2004-x64
7trojan-lea...ck.exe
windows7-x64
1trojan-lea...ck.exe
windows10-2004-x64
1trojan-lea...as.exe
windows7-x64
6trojan-lea...as.exe
windows10-2004-x64
6trojan-lea...ic.exe
windows7-x64
6trojan-lea...ic.exe
windows10-2004-x64
6trojan-lea...um.exe
windows7-x64
1trojan-lea...um.exe
windows10-2004-x64
1trojan-lea...um.exe
windows7-x64
8trojan-lea...um.exe
windows10-2004-x64
8trojan-lea...28.bat
windows7-x64
8trojan-lea...28.bat
windows10-2004-x64
8trojan-lea...28.exe
windows7-x64
8trojan-lea...28.exe
windows10-2004-x64
8trojan-lea...na.exe
windows7-x64
5trojan-lea...na.exe
windows10-2004-x64
5trojan-lea...um.exe
windows7-x64
8trojan-lea...um.exe
windows10-2004-x64
8trojan-lea...ty.exe
windows7-x64
1trojan-lea...ty.exe
windows10-2004-x64
1Resubmissions
09-05-2023 19:22
230509-x3fn4adg58 1009-05-2023 19:14
230509-xxsrgaff7x 1009-05-2023 19:14
230509-xxr5yadg42 709-05-2023 19:14
230509-xxrt6sff7w 809-05-2023 19:14
230509-xxrjeaff7v 809-05-2023 19:14
230509-xxqxwadg39 709-05-2023 19:14
230509-xxql4sff7t 1009-05-2023 19:14
230509-xxqbcadg38 709-05-2023 19:10
230509-xvl6xadf64 10Analysis
-
max time kernel
163s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09-05-2023 19:10
Behavioral task
behavioral1
Sample
trojan-leaks-main/Halloware (BerkayV).exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
trojan-leaks-main/Halloware (BerkayV).exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
trojan-leaks-main/HorrorTrojan123.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
trojan-leaks-main/HorrorTrojan123.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
trojan-leaks-main/InfiniteBlue.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
trojan-leaks-main/InfiniteBlue.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
trojan-leaks-main/Kirurg v2.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
trojan-leaks-main/Kirurg v2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
trojan-leaks-main/Kirurg.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
trojan-leaks-main/Kirurg.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
trojan-leaks-main/Kirurg_remsaterd.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
trojan-leaks-main/Kirurg_remsaterd.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
trojan-leaks-main/LogonFuck.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
trojan-leaks-main/LogonFuck.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
trojan-leaks-main/Mythlas.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
trojan-leaks-main/Mythlas.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
trojan-leaks-main/Phsyletric.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
trojan-leaks-main/Phsyletric.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
trojan-leaks-main/Potassium.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
trojan-leaks-main/Potassium.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
trojan-leaks-main/Protactinium.exe
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
trojan-leaks-main/Protactinium.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
trojan-leaks-main/QSO J1228+3128.bat
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
trojan-leaks-main/QSO J1228+3128.bat
Resource
win10v2004-20230221-en
Behavioral task
behavioral25
Sample
trojan-leaks-main/QSO J1228+3128.exe
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
trojan-leaks-main/QSO J1228+3128.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
trojan-leaks-main/Rebcoana.exe
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
trojan-leaks-main/Rebcoana.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
trojan-leaks-main/Ruthenium/Ruthenium.exe
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
trojan-leaks-main/Ruthenium/Ruthenium.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral31
Sample
trojan-leaks-main/Suffocate-safety.exe
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
trojan-leaks-main/Suffocate-safety.exe
Resource
win10v2004-20230220-en
General
-
Target
trojan-leaks-main/Ruthenium/Ruthenium.exe
-
Size
36KB
-
MD5
a1f174ce74dbe0e84e2c2964b29de0fd
-
SHA1
d4dd4b86ec50b2ea2519f5472642d30301e20aa3
-
SHA256
5066c3a750eb6f07addf5cee1e6b00894c52e1c4fbf1702befcd5ac9bf1d83f3
-
SHA512
41edeab57b55b74a22ac46814f985a78704b35c14d330d5264765ce9a22d19762659a47cfce13fcef28f322ed0a018976585dd65270690422b64b4860a2ecd31
-
SSDEEP
384:x6j2tyffbHj9X8EY5Z3absnexUDoRGAGYk2zWfAozcQcgJgyBkAg+jdGb90kGj:SDD9hYbqbhFZkeWoecuiATjXp
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Ruthenium.exedescription ioc process File opened for modification \??\PhysicalDrive0 Ruthenium.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1688 1340 WerFault.exe Ruthenium.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1528 taskkill.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskkill.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 1528 taskkill.exe Token: 33 1864 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1864 AUDIODG.EXE Token: 33 1864 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1864 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Ruthenium.execmd.execmd.exedescription pid process target process PID 1340 wrote to memory of 2036 1340 Ruthenium.exe cmd.exe PID 1340 wrote to memory of 2036 1340 Ruthenium.exe cmd.exe PID 1340 wrote to memory of 2036 1340 Ruthenium.exe cmd.exe PID 1340 wrote to memory of 2036 1340 Ruthenium.exe cmd.exe PID 2036 wrote to memory of 1528 2036 cmd.exe taskkill.exe PID 2036 wrote to memory of 1528 2036 cmd.exe taskkill.exe PID 2036 wrote to memory of 1528 2036 cmd.exe taskkill.exe PID 2036 wrote to memory of 1528 2036 cmd.exe taskkill.exe PID 1340 wrote to memory of 884 1340 Ruthenium.exe cmd.exe PID 1340 wrote to memory of 884 1340 Ruthenium.exe cmd.exe PID 1340 wrote to memory of 884 1340 Ruthenium.exe cmd.exe PID 1340 wrote to memory of 884 1340 Ruthenium.exe cmd.exe PID 884 wrote to memory of 1824 884 cmd.exe reg.exe PID 884 wrote to memory of 1824 884 cmd.exe reg.exe PID 884 wrote to memory of 1824 884 cmd.exe reg.exe PID 884 wrote to memory of 1824 884 cmd.exe reg.exe PID 1340 wrote to memory of 1688 1340 Ruthenium.exe WerFault.exe PID 1340 wrote to memory of 1688 1340 Ruthenium.exe WerFault.exe PID 1340 wrote to memory of 1688 1340 Ruthenium.exe WerFault.exe PID 1340 wrote to memory of 1688 1340 Ruthenium.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Ruthenium\Ruthenium.exe"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Ruthenium\Ruthenium.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\reg.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
PID:1824
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 5682⤵
- Program crash
PID:1688
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x58c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1864