hxxps://github[.]com/sorayuki/obs-multi-rtmp/releases/

Resubmissions

19-02-2024 10:15

240219-manh5ace98 8

17-09-2023 13:23

230917-qmw8ksaf5v 8

Analysis

max time kernel
66s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2023 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/sorayuki/obs-multi-rtmp/releases/

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3220	obs-multi-rtmp-0.5.0.1-windows-x64-Installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\obs-multi-rtmp-0.5.0.1-windows-x64-Installer.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\obs-multi-rtmp-0.5.0.1-windows-x64.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	firefox.exe
Token: SeDebugPrivilege	4876	firefox.exe
Token: SeDebugPrivilege	4876	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4876	2072	firefox.exe	84
PID 2072 wrote to memory of 4876	2072	firefox.exe	84
PID 2072 wrote to memory of 4876	2072	firefox.exe	84
PID 2072 wrote to memory of 4876	2072	firefox.exe	84
PID 2072 wrote to memory of 4876	2072	firefox.exe	84
PID 2072 wrote to memory of 4876	2072	firefox.exe	84
PID 2072 wrote to memory of 4876	2072	firefox.exe	84
PID 2072 wrote to memory of 4876	2072	firefox.exe	84
PID 2072 wrote to memory of 4876	2072	firefox.exe	84
PID 2072 wrote to memory of 4876	2072	firefox.exe	84
PID 2072 wrote to memory of 4876	2072	firefox.exe	84
PID 4876 wrote to memory of 4972	4876	firefox.exe	86
PID 4876 wrote to memory of 4972	4876	firefox.exe	86
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2180	4876	firefox.exe	87
PID 4876 wrote to memory of 2736	4876	firefox.exe	88
PID 4876 wrote to memory of 2736	4876	firefox.exe	88
PID 4876 wrote to memory of 2736	4876	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/sorayuki/obs-multi-rtmp/releases/"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/sorayuki/obs-multi-rtmp/releases/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4876.0.1179696434\215372193" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20860 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc789632-c4e3-4b38-b3d4-3719169d70e1} 4876 "\\.\pipe\gecko-crash-server-pipe.4876" 1980 1e2e99f4e58 gpu
    3⤵
    PID:4972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4876.1.136377925\1135888194" -parentBuildID 20221007134813 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 21676 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f56a41a2-775a-43b5-8c19-8ac185ab195a} 4876 "\\.\pipe\gecko-crash-server-pipe.4876" 2400 1e2e990bd58 socket
    3⤵
    - Checks processor information in registry
    PID:2180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4876.2.2051848482\1605160684" -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 3092 -prefsLen 21714 -prefMapSize 232645 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcfc6a77-83d5-4ad0-942c-c6fc7d3fd57f} 4876 "\\.\pipe\gecko-crash-server-pipe.4876" 3108 1e2edbd1058 tab
    3⤵
    PID:2736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4876.3.1840406570\29172547" -childID 2 -isForBrowser -prefsHandle 3956 -prefMapHandle 3952 -prefsLen 26359 -prefMapSize 232645 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {180a80cb-70f3-4cd8-b122-fad3cba9fffe} 4876 "\\.\pipe\gecko-crash-server-pipe.4876" 3968 1e2dd062058 tab
    3⤵
    PID:2808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4876.4.1674989592\623304788" -childID 3 -isForBrowser -prefsHandle 4440 -prefMapHandle 2744 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c35ae198-998c-4f12-a5c4-b0b62443ae78} 4876 "\\.\pipe\gecko-crash-server-pipe.4876" 4364 1e2efec8e58 tab
    3⤵
    PID:220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4876.6.1392459570\1852692891" -childID 5 -isForBrowser -prefsHandle 5244 -prefMapHandle 5248 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6bf5e617-d503-4d61-bbbe-5665a5284f8a} 4876 "\\.\pipe\gecko-crash-server-pipe.4876" 5236 1e2efec6458 tab
    3⤵
    PID:4880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4876.5.247665299\1970905999" -childID 4 -isForBrowser -prefsHandle 4512 -prefMapHandle 4896 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7358a9b-88ec-4059-896b-116adfce0292} 4876 "\\.\pipe\gecko-crash-server-pipe.4876" 4968 1e2f0126358 tab
    3⤵
    PID:4992
- - C:\Users\Admin\Downloads\obs-multi-rtmp-0.5.0.1-windows-x64-Installer.exe
    "C:\Users\Admin\Downloads\obs-multi-rtmp-0.5.0.1-windows-x64-Installer.exe"
    3⤵
    - Executes dropped EXE
    PID:3220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
25bbeef606f113026008d6a71a6dbae9

SHA1
86204158bdcb4fd9d04e0f97d230dbe66f97ecbb

SHA256
a6902e66e5bdc6992292b6fe8e5bb7e7ab4011b47c248dd067b04460f38f0386

SHA512
df39cb8451f44c4062fcda1d0e3587b244a94d2bbb12be81bd7085ae561e26a84409ccbac163fec66e40a3ee4656e682d965fb2739345e8fd9152c4a51d42b11

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\prefs-1.js

Filesize
6KB

MD5
af701ab4d39f5f9dc5c73f6f0116bda9

SHA1
92036c176770272f76ebfd3a7fe4492e16a6cb84

SHA256
8db58e6da208b97b0e0bdb0fa1b625100ef09a47016939627a8c6e65ccdf0b99

SHA512
857e5576e14f2727b774f2afc6819cd0b5a5f1524987d517c08db51962b6dd796d2c40561ff91f6f8488a2bfb3dcf92883967b2fe7743fbbfaf1a7621d3989d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\prefs-1.js

Filesize
6KB

MD5
9b064e7cec5727d782a2f469b851d9e3

SHA1
b8ad039aff622ea267a218b0f39bbf25ada67a8b

SHA256
3f2770318d48600784059328d9ef1fe5197661048060169c6e27a09b1d16a952

SHA512
e9501a6f2dbd2f03f7a8cccc9e4dc3bd2bd2cfa5ae6beb576e215c4bc4dcddc868b30ab34cf52e0013631572b8af10c9026d912230868c8d5f47edf5b9575ad4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\prefs-1.js

Filesize
6KB

MD5
d0b961f1c07d48febcdbe5cb480ed599

SHA1
f452b4ef0ec194abc7fbfca642cadbb4345a8caa

SHA256
21d429e5da56382608caf0174ccd3f13d8e37ae1f6f03986b8c72036f45fda5f

SHA512
b3b4e286582b48b0f4fc75d5aba01a0afadf3a973781c4cf4b748d771029e563fccc6c86e0874b40fa5d523142099e32b4072babd8a450cfb6b04f2840f17fc5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\prefs.js

Filesize
6KB

MD5
036df6f37f6629f841d85b12c20c44a1

SHA1
c850bd3753b1d1bc1bed8a69992a640773e1896a

SHA256
30d094e635c9b96899a86ea5769c75faed62c7d41797296c91d1aebfba637a82

SHA512
ef50997a61f676065677f0b5383e3ca0a924b0cbe17b568fe567eb3545cbb15046cb109034d5c20bc9f9fabca62dad45bce44666f69dd379927d4e629e742919

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\prefs.js

Filesize
6KB

MD5
4125e247733c93252c19ff1ba3478d78

SHA1
cd09e923c88c9c98ef3c2fabfc354b782c1f9572

SHA256
8dc3b325059cbd993b34dcba09d60713d6d07817d1cf0b3d5506ba0c4357005b

SHA512
a603c183132f50b6dd20ce6a2a23913ad4c39916d210b29c7e62da39b8b7df17755ee47aca966a5e6153acf844783d8d1a6a475d2e788e84452b9fd6cecce62f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
130370f9827f01bfea5e883124e56856

SHA1
0246973aa53dbbeb6a65ecf7fd8e24a953a4c126

SHA256
aa5a45bfbb1f73eb33656027113e617b838ed5e7e33410e5f52deca1374f5cf3

SHA512
b7fbd98cc1ff2d51f8f9bb360775986c5a82db47db4eb99d621c070146c5355d5d7897ae19ea0f67ad8c78482e1d0775f3f031cae469519dc6375e6b6be4dc81

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
c479df249c0b101175b75285acf6b9bc

SHA1
db1286d66415eb2fa3f0ab5571cea04408354acf

SHA256
3b4fc5f49d449452a235499adf55e6e7ae562816df52a108c2658b5549918401

SHA512
1b7d36acd9d84305528a060663d569b570b2fbe299b7d644aabaec375fff3c4c3da6ba8b4c9a3dbd58217e7884e79c1fa70ba6cb250ec5f29ac84c9e322a4aef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\sessionstore.jsonlz4

Filesize
2KB

MD5
fca2bd4ed88e99d4eff5bb65d4efa1a4

SHA1
3790f326e57320ef568fdd37b3853ce00c839c49

SHA256
d078ce7201bf7c8a6d0442ce340761589b1f27f824ecdffffd79f6842499427f

SHA512
11390f3214645df25bba3a3f86970e8d458fc90472bce239e97cfae3bfe61002a627d64c90684f417ec468e9533f587cdc19a5cefc483321940814aa7085f613

Download Submit
C:\Users\Admin\Downloads\obs-multi-rtmp-0.5.0.1-windows-x64-Installer.exe

Filesize
1.1MB

MD5
014adb355818bd01e78ff7cb69a45a7a

SHA1
a60d47172c3d79bb304c983694d7898e61518648

SHA256
877de4f7acda5262f29277492e9bc1269173c5f6a764e141bca7b50cf1a51c1f

SHA512
6aca0062269b836342e4dbabd486c83aa6b1c4d714b05ff0a50149d7064f48cf90e8c4ccc98dbfc24e081acb07f3ed9b4618921834200fe8c7518109a0a7951c

Download Submit
C:\Users\Admin\Downloads\obs-multi-rtmp-0.5.0.1-windows-x64-Installer.exe

Filesize
1.1MB

MD5
014adb355818bd01e78ff7cb69a45a7a

SHA1
a60d47172c3d79bb304c983694d7898e61518648

SHA256
877de4f7acda5262f29277492e9bc1269173c5f6a764e141bca7b50cf1a51c1f

SHA512
6aca0062269b836342e4dbabd486c83aa6b1c4d714b05ff0a50149d7064f48cf90e8c4ccc98dbfc24e081acb07f3ed9b4618921834200fe8c7518109a0a7951c

Download Submit
C:\Users\Admin\Downloads\obs-multi-rtmp-0.a_-4AsWJ.5.0.1-windows-x64.zip.part

Filesize
1.8MB

MD5
82515ff9874d6b26287cd59d9c8f0a06

SHA1
e2da13e32742c1ba783da7e895477b11ad9e3b07

SHA256
f2529cd2895a942452b6e161e05411051aafba0acd53840936139a824dd1f524

SHA512
5c02b784040a1efb8ee72387729975bcd20cf71f03ea7dccfbd3ed102e81a6443ea2ded4883bef024949f397522598cbb4cb40a39ad0265a341b5f2674111af3

Download Submit
C:\Users\Admin\Downloads\obs-multi-rtmp-0.siw-21jj.5.0.1-windows-x64-Installer.exe.part

Filesize
1.1MB

MD5
014adb355818bd01e78ff7cb69a45a7a

SHA1
a60d47172c3d79bb304c983694d7898e61518648

SHA256
877de4f7acda5262f29277492e9bc1269173c5f6a764e141bca7b50cf1a51c1f

SHA512
6aca0062269b836342e4dbabd486c83aa6b1c4d714b05ff0a50149d7064f48cf90e8c4ccc98dbfc24e081acb07f3ed9b4618921834200fe8c7518109a0a7951c

Download Submit