18fb1efac7a965e3be1b7c090324e291fcdaba65ec213619d245aa4aa54387ba

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RADMIR_LAUNCHER.exe
Size

136KB
MD5

f65724f439f3ac47153fdec32d5d58fb
SHA1

9c842169664f734426e8d0b87ed068e554ea11c4
SHA256

c3566150c632c7cae3b96de78f5e5d7a3b816ce1b9a013ef74b326bb75df84c9
SHA512

10d3bf90b1f291494031cea1b14a9c55d30c75856bbeb8975585896016cf83b0d895f3edd9d28bb8867406979bb0b2922a6e28f93feff5b5dbd98aa5435f4745
SSDEEP

3072:voLN5XpO8MjeE/u17JJSlZo7yFeRNCZ7+vWm9wY6n:vru17Jml8w5d

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	RADMIR_LAUNCHER.exe

Loads dropped DLL 1 IoCs

pid	Process
2900	RADMIR_LAUNCHER_EX.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
756	RADMIR_LAUNCHER_EX.exe
756	RADMIR_LAUNCHER_EX.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1228	RADMIR_LAUNCHER_EX.exe
1228	RADMIR_LAUNCHER_EX.exe
4456	RADMIR_LAUNCHER_EX.exe
4456	RADMIR_LAUNCHER_EX.exe
1076	RADMIR_LAUNCHER_EX.exe
1076	RADMIR_LAUNCHER_EX.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe
1560	RADMIR_LAUNCHER.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2396	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2396	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2900	RADMIR_LAUNCHER_EX.exe
2900	RADMIR_LAUNCHER_EX.exe
2900	RADMIR_LAUNCHER_EX.exe
2900	RADMIR_LAUNCHER_EX.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2900	RADMIR_LAUNCHER_EX.exe
2900	RADMIR_LAUNCHER_EX.exe
2900	RADMIR_LAUNCHER_EX.exe
2900	RADMIR_LAUNCHER_EX.exe
2900	RADMIR_LAUNCHER_EX.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2900	1560	RADMIR_LAUNCHER.exe	86
PID 1560 wrote to memory of 2900	1560	RADMIR_LAUNCHER.exe	86
PID 1560 wrote to memory of 2900	1560	RADMIR_LAUNCHER.exe	86
PID 2900 wrote to memory of 756	2900	RADMIR_LAUNCHER_EX.exe	89
PID 2900 wrote to memory of 756	2900	RADMIR_LAUNCHER_EX.exe	89
PID 2900 wrote to memory of 756	2900	RADMIR_LAUNCHER_EX.exe	89
PID 2900 wrote to memory of 1228	2900	RADMIR_LAUNCHER_EX.exe	90
PID 2900 wrote to memory of 1228	2900	RADMIR_LAUNCHER_EX.exe	90
PID 2900 wrote to memory of 1228	2900	RADMIR_LAUNCHER_EX.exe	90
PID 2900 wrote to memory of 4456	2900	RADMIR_LAUNCHER_EX.exe	92
PID 2900 wrote to memory of 4456	2900	RADMIR_LAUNCHER_EX.exe	92
PID 2900 wrote to memory of 4456	2900	RADMIR_LAUNCHER_EX.exe	92
PID 2900 wrote to memory of 1076	2900	RADMIR_LAUNCHER_EX.exe	94
PID 2900 wrote to memory of 1076	2900	RADMIR_LAUNCHER_EX.exe	94
PID 2900 wrote to memory of 1076	2900	RADMIR_LAUNCHER_EX.exe	94

C:\Users\Admin\AppData\Local\Temp\RADMIR_LAUNCHER.exe
"C:\Users\Admin\AppData\Local\Temp\RADMIR_LAUNCHER.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Local\Temp\RADMIR_LAUNCHER_EX.exe
  "C:\Users\Admin\AppData\Local\Temp\RADMIR_LAUNCHER_EX.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\RADMIR_LAUNCHER_EX.exe
    "C:\Users\Admin\AppData\Local\Temp\RADMIR_LAUNCHER_EX.exe" --type=gpu-process --field-trial-handle=1836,2923329607940793516,14552450733043758168,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --no-sandbox --disable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\radmir-launcher" --gpu-preferences=UAAAAAAAAADgAgAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=1840 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\RADMIR_LAUNCHER_EX.exe
    "C:\Users\Admin\AppData\Local\Temp\RADMIR_LAUNCHER_EX.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,2923329607940793516,14552450733043758168,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\radmir-launcher" --mojo-platform-channel-handle=2108 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1228
- - C:\Users\Admin\AppData\Local\Temp\RADMIR_LAUNCHER_EX.exe
    "C:\Users\Admin\AppData\Local\Temp\RADMIR_LAUNCHER_EX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\radmir-launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --field-trial-handle=1836,2923329607940793516,14552450733043758168,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2396 /prefetch:1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4456
- - C:\Users\Admin\AppData\Local\Temp\RADMIR_LAUNCHER_EX.exe
    "C:\Users\Admin\AppData\Local\Temp\RADMIR_LAUNCHER_EX.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1836,2923329607940793516,14552450733043758168,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\radmir-launcher" --mojo-platform-channel-handle=2412 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c4 0x2c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\192efa87-13e6-4f14-a65c-04b4cd6157e4.tmp.node

Filesize
1.9MB

MD5
feb305765b1ed89c75a8188a4ae19470

SHA1
effce4b7127122160dfe03007f8a82d88abf9037

SHA256
b4abe57b57569b5a9378ac7481fa9785f2eb2d51976fd01c22f28ce0153e7e1d

SHA512
235e84e6e927be6bc637f8594ae8fe2ca3744d93b601a8c291a5df4125390efbb79b112ec3fdcb9478b4c60737b85856b1894bee974482936f4db561256568f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\2024-01-28 14-10-23.log

Filesize
4KB

MD5
244de0ce9bdbdf772aec9590c79757af

SHA1
0e7179e46f81709cee7dddecd993aec2e3b3e611

SHA256
804e4f52b3889dd885163868feb2389655f7e3d4453320638b446e53addcc34e

SHA512
ba8c58a56c5eb7f86f4236babcf77cdf05323e42ad9b4a40dbcc7b4f53f3d6ee48fbc444e923bf978881b39805f172496de2c6509c61e3edd994bc717934feab

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\2024-01-28 14-10-23.log

Filesize
761B

MD5
16ab8467210ba3d4e7154dbbd5d080c9

SHA1
787d6cad7ad8296ea06ce8d7d8d0ce6de6e76a51

SHA256
9291fbfa28f3ebe464a3b736eb799d14034dc16282bac71f0b8b15e80e6222da

SHA512
034bb60d740e7c7a8366c75c55f88d7a3d4eb82f12292c309a0c9f971096c59239badcd1f918b6a200a51c8493afab9e0167308f4e63fd587305476c8915b8c9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\radmir-launcher\Network Persistent State

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\radmir-launcher\Network Persistent State

Filesize
393B

MD5
5e62deaf16d09f8344dfd90402d0523a

SHA1
72e357574f3a20dfb49380a942cc53f9704a159d

SHA256
3e2feedf1b07b8686a3012200f6d297050bb351fe2fbd55428a2f8022f0e3b47

SHA512
965243905fdf66fbd9f96c9900fea529cbe9ff50a04cc5d9fc9b1bca1b30cded90a371243c4a99e194c4a52791a0dbaef7cb316235ed3d2c66d71c7ec78c91f1

Download Submit