Analysis
-
max time kernel
158s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 13:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a89fe17499bc3d3d87057232fc768ed.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a89fe17499bc3d3d87057232fc768ed.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1a89fe17499bc3d3d87057232fc768ed.exe
-
Size
204KB
-
MD5
1a89fe17499bc3d3d87057232fc768ed
-
SHA1
a185c38bbae5492b22f062cbd3d88cd2bf2253db
-
SHA256
474bb149cf9553eca0e0429d18443f3be17b267c2de587db6e16644a68fc90bc
-
SHA512
8f8827e57a328c7dceba5db0202b91cf32b3f0688a0a752a91029b77d2545fa87b9f6786c9184397b6663468770c290d8bdde3824db3ef98319cb9df03a8f69e
-
SSDEEP
3072:UuqeZBXj3pZgjxp8HRfW+Ida220gN4JsBi40BuWNVYrcLwcYieNRrhomiyTfXIK:UFyxDpZgdORfWTmiDBuhTIaxu+7qT
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rcrad.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 1a89fe17499bc3d3d87057232fc768ed.exe -
Executes dropped EXE 1 IoCs
pid Process 4620 rcrad.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /e" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /c" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /V" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /y" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /a" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /t" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /E" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /D" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /H" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /m" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /A" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /G" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /C" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /Y" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /f" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /L" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /i" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /b" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /F" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /P" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /z" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /W" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /I" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /r" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /v" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /j" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /O" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /o" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /X" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /Q" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /n" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /s" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /M" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /S" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /g" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /B" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /p" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /h" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /d" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /u" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /U" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /R" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /T" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /w" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /K" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /Z" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /N" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /q" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /k" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /l" rcrad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcrad = "C:\\Users\\Admin\\rcrad.exe /J" rcrad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe 4620 rcrad.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4764 1a89fe17499bc3d3d87057232fc768ed.exe 4620 rcrad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4764 wrote to memory of 4620 4764 1a89fe17499bc3d3d87057232fc768ed.exe 92 PID 4764 wrote to memory of 4620 4764 1a89fe17499bc3d3d87057232fc768ed.exe 92 PID 4764 wrote to memory of 4620 4764 1a89fe17499bc3d3d87057232fc768ed.exe 92 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87 PID 4620 wrote to memory of 4764 4620 rcrad.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a89fe17499bc3d3d87057232fc768ed.exe"C:\Users\Admin\AppData\Local\Temp\1a89fe17499bc3d3d87057232fc768ed.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\rcrad.exe"C:\Users\Admin\rcrad.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5db01f269a5bc966d5b92edfa4b404369
SHA1fb084e720800a2d46d941570deda06ec5b660bc9
SHA2567c150271fac1c598e20fa0b31e82d8acf2de999141a8561c03e7109647cfd16a
SHA5129c4148e3f9507950353d1dfe9ca570fa3cec51afce0f18fff83ccce49048e2085ccfb7a18742ad49ec129b58e714437c8df23942dcef24a683b1ca32ccc67a56