17da20b574a032fe666b373e92704b10ee26f3ab0a2a1258336e5d0aa9a6c2c6

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$LOCALAPPDATA/RavenBleuSA/bin/1.0.15.0/$OUTDIR/RavenBleuUninstaller.exe
Size

144KB
MD5

0e6df786ab3ecda3b43cd1d656492a4a
SHA1

a4cc62590def9182576bbdeea7aa6ebcdb071ae9
SHA256

d2ac8a821abda1a921e04c25d010db4aae74329eefa9059688c0fc47d24363b8
SHA512

a651a580db4fa90ce33b24590d7eab64a91fa8fa5d77989708505f497225b9902dc9b629ba46c55134a0d297c729675fe879c36eb2277606bdfce2e5eac1ddb3
SSDEEP

3072:nQIURTXJHAAX13Jyx7qFTbNRB+z1+Yi/VruwVPhw2AqaCd+VtY:nsirx7qFT5+h+L/VKYazGdIY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2336	Au_.exe

Loads dropped DLL 2 IoCs

pid	Process
2252	RavenBleuUninstaller.exe
2336	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral3/files/0x0033000000015c64-2.dat	nsis_installer_1
behavioral3/files/0x0033000000015c64-2.dat	nsis_installer_2

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	Au_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2336	2252	RavenBleuUninstaller.exe	27
PID 2252 wrote to memory of 2336	2252	RavenBleuUninstaller.exe	27
PID 2252 wrote to memory of 2336	2252	RavenBleuUninstaller.exe	27
PID 2252 wrote to memory of 2336	2252	RavenBleuUninstaller.exe	27

C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.15.0\$OUTDIR\RavenBleuUninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.15.0\$OUTDIR\RavenBleuUninstaller.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.15.0\$OUTDIR\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsj68E3.tmp\Install.dll

Filesize
276KB

MD5
9d6dfc7dceb09ed2308447045ce7036f

SHA1
2b6fc09cfec4cd9be5e0ba546c1d84634df43d00

SHA256
e83136b0ad2ad660c0287cb2a6716442c69939b9ab4ccded54f2c7413d635cf9

SHA512
6836feeb029f66eb6e08a52aaed36f2341a7d5df71b253835d4a668992e8d62623b716b510c238b342964a2d54a63a90794e031db4f2df39d1a5ef62748acefc

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
144KB

MD5
0e6df786ab3ecda3b43cd1d656492a4a

SHA1
a4cc62590def9182576bbdeea7aa6ebcdb071ae9

SHA256
d2ac8a821abda1a921e04c25d010db4aae74329eefa9059688c0fc47d24363b8

SHA512
a651a580db4fa90ce33b24590d7eab64a91fa8fa5d77989708505f497225b9902dc9b629ba46c55134a0d297c729675fe879c36eb2277606bdfce2e5eac1ddb3

Download Submit