1070b4766e0979a8e15ddbd3d0ba27a9d05272027b3a20eaaf9c9fd854f2def7

Analysis

max time kernel
33s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2023 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Netflix Tools PACK/Netflix Tools PACK/Netflix password changer + capture by RubiconT/Netflix by Rubicon.exe
Size

172KB
MD5

4b3932d6fc6e2674dfa011acb61420d8
SHA1

176e8aa6400722202ad7238c80008409eea9c872
SHA256

843c667a85ea8f5f586c34ab9b290d4bb8323b27c867239576e8a5530a6181b4
SHA512

1d0ac9ef84ca0efca022963fabe9468475447c149accdde1d5e497951cc84a4d5aef54ad0e6a470600f3e0ebbb7a66ddc4269146155a5b8c57af0c60844cc68d
SSDEEP

3072:g4lqQW95d30WXGTwqbvqM+BfFH+nV67JO8VXa:g6qQW95dEWXybFcfyV6tlVX

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Netflix by Rubicon.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Control Panel\International\Geo\Nation	Netflix by Rubicon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Launcher.exe

pid process

2200 Launcher.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Launcher.exe

description pid process

Token: SeDebugPrivilege 2200 Launcher.exe

pid	process
2200	Launcher.exe

description	pid	process
Token: SeDebugPrivilege	2200	Launcher.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Netflix by Rubicon.exe

description	pid	process	target process
PID 5044 wrote to memory of 2200	5044	Netflix by Rubicon.exe	Launcher.exe
PID 5044 wrote to memory of 2200	5044	Netflix by Rubicon.exe	Launcher.exe
PID 5044 wrote to memory of 2200	5044	Netflix by Rubicon.exe	Launcher.exe
PID 5044 wrote to memory of 2572	5044	Netflix by Rubicon.exe	RubiconSoft.exe
PID 5044 wrote to memory of 2572	5044	Netflix by Rubicon.exe	RubiconSoft.exe
PID 5044 wrote to memory of 2572	5044	Netflix by Rubicon.exe	RubiconSoft.exe

C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix password changer + capture by RubiconT\Netflix by Rubicon.exe
"C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix password changer + capture by RubiconT\Netflix by Rubicon.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix password changer + capture by RubiconT\nsi\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix password changer + capture by RubiconT\nsi\Launcher.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix password changer + capture by RubiconT\nsi\RubiconSoft.exe
  "C:\Users\Admin\AppData\Local\Temp\Netflix Tools PACK\Netflix Tools PACK\Netflix password changer + capture by RubiconT\nsi\RubiconSoft.exe"
  2⤵
  PID:2572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-140-0x0000000000DB0000-0x0000000000DC4000-memory.dmp

Filesize
80KB

Download
memory/2200-141-0x0000000006C90000-0x0000000006D0E000-memory.dmp

Filesize
504KB

Download
memory/2200-142-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/2572-143-0x00000000006F0000-0x0000000000716000-memory.dmp

Filesize
152KB

Download
memory/5044-133-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Filesize
192KB

Download
memory/5044-134-0x0000000005610000-0x00000000056AC000-memory.dmp

Filesize
624KB

Download
memory/5044-135-0x0000000005CB0000-0x0000000006254000-memory.dmp

Filesize
5.6MB

Download
memory/5044-136-0x00000000057A0000-0x0000000005832000-memory.dmp

Filesize
584KB

Download
memory/5044-137-0x0000000005730000-0x000000000573A000-memory.dmp

Filesize
40KB

Download
memory/5044-138-0x00000000059A0000-0x00000000059F6000-memory.dmp

Filesize
344KB

Download
memory/5044-139-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download