Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 19:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a49924a6a0cfc4f55e5ddd505ce26aa1.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a49924a6a0cfc4f55e5ddd505ce26aa1.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a49924a6a0cfc4f55e5ddd505ce26aa1.exe
-
Size
268KB
-
MD5
a49924a6a0cfc4f55e5ddd505ce26aa1
-
SHA1
c9369e50820fdbf534849e7d6bae42b46286e0cd
-
SHA256
32b25aa41ee05167c9c5f842ee118722f9f562008f5619d88da3a8592021ae6e
-
SHA512
16b3eb880c8eaac013ab32de8a8c488b4e8d17346902dd24c0cf58e4aea391f036996934a661ab6990f9ca868fdd77f17dafbf28ea4eae93fef69236e75aabd8
-
SSDEEP
3072:NE4raqnywSksPUTVY7fhINP7JbfLBsyVEJ8Ixjtmkp44upWuTNgX8Tjee/L1pvQu:qMmsgfuNPp5VEVtmk4DAuTxeOx
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a49924a6a0cfc4f55e5ddd505ce26aa1.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rvbiop.exe -
Executes dropped EXE 1 IoCs
pid Process 2800 rvbiop.exe -
Loads dropped DLL 2 IoCs
pid Process 1968 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 1968 a49924a6a0cfc4f55e5ddd505ce26aa1.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /v" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /s" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /i" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /d" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /k" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /s" a49924a6a0cfc4f55e5ddd505ce26aa1.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /x" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /w" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /h" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /r" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /q" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /u" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /m" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /g" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /f" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /c" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /b" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /a" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /n" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /y" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /o" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /z" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /e" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /t" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /p" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /j" rvbiop.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\rvbiop = "C:\\Users\\Admin\\rvbiop.exe /l" rvbiop.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1968 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe 2800 rvbiop.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1968 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 2800 rvbiop.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2800 1968 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 28 PID 1968 wrote to memory of 2800 1968 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 28 PID 1968 wrote to memory of 2800 1968 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 28 PID 1968 wrote to memory of 2800 1968 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a49924a6a0cfc4f55e5ddd505ce26aa1.exe"C:\Users\Admin\AppData\Local\Temp\a49924a6a0cfc4f55e5ddd505ce26aa1.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\rvbiop.exe"C:\Users\Admin\rvbiop.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5701824c1daca5611e98e95aa60f89924
SHA11bfa08c0b9dec3d34fb4814645e5d0f2e234cd93
SHA25693492c24a4f3c6d5b355e2e1badce8809f20093a8b4397c2df657c88f8403e0e
SHA5120cd64482002e4e4dea2b5f9df0aeebf128536662e7ae146b5860acd8f735a2d73739acce3eae086cfc9f56bef350b8b0c80932319e49b3e534680b21b582c7fd
-
Filesize
56KB
MD53a38b3f5abe171bdc565a59101c09ec3
SHA13615006e32131983d5cc14aee51c099ab0042864
SHA256728fbfc2a31d0620281defadb56479423c7ebd3ac4271597bd7bb73a95c9dee6
SHA5125c71a659d9878b0118e8f1646f7693dde2aa916757feab3f765b30b7037f785cab70c3cb2f81ca4d3a250828ae92e0f79d39213ab1f6e1c184be5af98d68501e
-
Filesize
48KB
MD55d63bc939a7432923531e0d78a5694ba
SHA13ca8a4ef44c960118a6dc12a1a8c462a72cb83f5
SHA25600eb733e85be468b71039bfd7057361d7cf5d1a418f1ae9d83dffdee67b26b16
SHA512f812bfea50e09393bba05112e12f9085d52dcf4ab527dbce581b24e979c7e16662d9523a4e349831fbd75337b9a80dcea8d18f290eb7aedf3406c1176a2b8e76
-
Filesize
44KB
MD59e5823ebd5fe76ec38c718400e42f8fb
SHA16b54c17d875d14a2e4ccc3ce635d2a0be9d9cd86
SHA256618454b0310821af2eb5f5584bed773050de8bb68edafd299047a9d1c30ed0cd
SHA51206b90be17008a1aaedf797ba514fd91dbb18d364465a28146c89bfc5924af30e0185d51224af211f3d5af7d6f50cb624a05a9fa0f88a0d3ab5cb509fcbea9634
-
Filesize
28KB
MD5770a58cff6da5f97f321808220bb176b
SHA124be609fd13ab91c8b286d9af47d8063b5ebecb0
SHA256f7567badea9a6c5754ad9efd95c3f03fbb2049f8479382e81518942a078d8098
SHA51264d3692f332dffe09ef8ad9955e4b5f596b5eae347c1753b80da84ab6288d15ca7f379b57d87d88b1357dc31b52ef2afd93462dbf6dc281bb9a4487923699e2b