98c830e1f593c1eae961b44822ac2990df90e214aad17cc9c3caf19b09005f7e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

493610666610bb568fb1fb2a29dfc86a.exe
Size

531KB
MD5

493610666610bb568fb1fb2a29dfc86a
SHA1

96364789f310a0d3747e538d88cf38bd89cd7eba
SHA256

98c830e1f593c1eae961b44822ac2990df90e214aad17cc9c3caf19b09005f7e
SHA512

a5bb73054286b49f208267bcfff8cc0794b2fce111a159229c72e1f7dcb37a91d4d47a92925364b2fa3875e3807cc9424b87c22623a75d19e8d7b2ad866a0167
SSDEEP

12288:2Qv0eBwZPTf7+y1dKluklBIy/8YwA7GH4:H82Wb7+SEP/RJG4

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,riodrv.exe"	493610666610bb568fb1fb2a29dfc86a.exe

Executes dropped EXE 1 IoCs

pid	Process
1312	riodrv.exe

Loads dropped DLL 2 IoCs

pid	Process
3068	493610666610bb568fb1fb2a29dfc86a.exe
3068	493610666610bb568fb1fb2a29dfc86a.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3068-0-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/3068-13-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/1312-15-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/1312-16-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/files/0x000c000000011fde-9.dat	upx
behavioral1/files/0x000c000000011fde-8.dat	upx
behavioral1/memory/3068-6-0x0000000003850000-0x00000000038D6000-memory.dmp	upx
behavioral1/files/0x000c000000011fde-5.dat	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\riodrv.exe	493610666610bb568fb1fb2a29dfc86a.exe
File created	C:\Windows\SysWOW64\riodrv.exe	493610666610bb568fb1fb2a29dfc86a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1312	3068	493610666610bb568fb1fb2a29dfc86a.exe	20
PID 3068 wrote to memory of 1312	3068	493610666610bb568fb1fb2a29dfc86a.exe	20
PID 3068 wrote to memory of 1312	3068	493610666610bb568fb1fb2a29dfc86a.exe	20
PID 3068 wrote to memory of 1312	3068	493610666610bb568fb1fb2a29dfc86a.exe	20

C:\Users\Admin\AppData\Local\Temp\493610666610bb568fb1fb2a29dfc86a.exe
"C:\Users\Admin\AppData\Local\Temp\493610666610bb568fb1fb2a29dfc86a.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\riodrv.exe
  "C:\Windows\system32\riodrv.exe"
  2⤵
  - Executes dropped EXE
  PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\riodrv.exe

Filesize
86KB

MD5
70488f365cf7b8fdfd54e5404bea880e

SHA1
700cc6f7231b0a7a8703fccad22f48fea1871248

SHA256
db46776678dc4136512d80b7e2ff104b900cdd8e2901a20ee6515b96639b1586

SHA512
f6185f41f1159f0e3435bdb307b362f2ca71eb6fd05a82f5fcbb81a7ec329560ec497cfac3beba57a279bfc4a58d8bc7b0690643626c968772f2a0dbcdcc5335

Download Submit
\Windows\SysWOW64\riodrv.exe

Filesize
92KB

MD5
1b65f99f356b9184131a97e5f670ce1a

SHA1
9e49dbacee27b2d84cbddf200539224e80896c25

SHA256
d2d066b3e2aa0d8fb654db56aee51ba3cebf3172010c773076c07d8204e1db85

SHA512
8a0590892372e94599d46e5e83d92cc71455ac8cbe723f527e096ea0fcc8f415d224758b28effeada2fcafa60a5faea0da562431e4cfe5605e8a55fc10691d89

Download Submit
memory/1312-14-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1312-15-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1312-16-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3068-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3068-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3068-13-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3068-6-0x0000000003850000-0x00000000038D6000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads