Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 15:46
Static task
static1
Behavioral task
behavioral1
Sample
RvcDownloader.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
RvcDownloader.exe
Resource
win10v2004-20231215-en
General
-
Target
RvcDownloader.exe
-
Size
1.1MB
-
MD5
7f6ce9a396cae9d375cb1a56de268b84
-
SHA1
4129cc4492f057cc2ec78c195c1badd7ab3d9c65
-
SHA256
604d490b9d5dfff01c9fceb085798c6b42f5778c9f125457be654dc4f436ab04
-
SHA512
e3cfe5afbde8b7889767cd9556ddbff2a3652ab139f06f02ec27cbd638d05604b3cbd5dcc2732a62750ced77d32eeab69b92e7eca38fe434121611c8775c314d
-
SSDEEP
24576:YAKoSJz+0Iw0kyFKLjA4OInTbghKT+5YqyIkIIWV+05rk4o/iq6MH:HCS7wDNjA4OIPiDGqyIkHfy0N
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Executes dropped EXE 4 IoCs
pid Process 1724 Dllhost.exe 2680 Server.exe 2480 Server.exe 2812 Server.exe -
Loads dropped DLL 1 IoCs
pid Process 2060 RvcDownloader.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 2 2.tcp.eu.ngrok.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 22 IoCs
pid Process 2060 RvcDownloader.exe 1724 Dllhost.exe 1724 Dllhost.exe 1724 Dllhost.exe 2680 Server.exe 1724 Dllhost.exe 1724 Dllhost.exe 1724 Dllhost.exe 1724 Dllhost.exe 1724 Dllhost.exe 2480 Server.exe 1724 Dllhost.exe 2480 Server.exe 1724 Dllhost.exe 1724 Dllhost.exe 1724 Dllhost.exe 1724 Dllhost.exe 1724 Dllhost.exe 2812 Server.exe 2812 Server.exe 1724 Dllhost.exe 1724 Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2936 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2060 RvcDownloader.exe 1724 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe Token: 33 1724 Dllhost.exe Token: SeIncBasePriorityPrivilege 1724 Dllhost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2060 RvcDownloader.exe 1724 Dllhost.exe 2680 Server.exe 2480 Server.exe 2812 Server.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2060 wrote to memory of 1724 2060 RvcDownloader.exe 28 PID 2060 wrote to memory of 1724 2060 RvcDownloader.exe 28 PID 2060 wrote to memory of 1724 2060 RvcDownloader.exe 28 PID 2060 wrote to memory of 1724 2060 RvcDownloader.exe 28 PID 1724 wrote to memory of 2936 1724 Dllhost.exe 29 PID 1724 wrote to memory of 2936 1724 Dllhost.exe 29 PID 1724 wrote to memory of 2936 1724 Dllhost.exe 29 PID 1724 wrote to memory of 2936 1724 Dllhost.exe 29 PID 2704 wrote to memory of 2680 2704 taskeng.exe 32 PID 2704 wrote to memory of 2680 2704 taskeng.exe 32 PID 2704 wrote to memory of 2680 2704 taskeng.exe 32 PID 2704 wrote to memory of 2680 2704 taskeng.exe 32 PID 2704 wrote to memory of 2480 2704 taskeng.exe 36 PID 2704 wrote to memory of 2480 2704 taskeng.exe 36 PID 2704 wrote to memory of 2480 2704 taskeng.exe 36 PID 2704 wrote to memory of 2480 2704 taskeng.exe 36 PID 2704 wrote to memory of 2812 2704 taskeng.exe 37 PID 2704 wrote to memory of 2812 2704 taskeng.exe 37 PID 2704 wrote to memory of 2812 2704 taskeng.exe 37 PID 2704 wrote to memory of 2812 2704 taskeng.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\RvcDownloader.exe"C:\Users\Admin\AppData\Local\Temp\RvcDownloader.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
PID:2936
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {F354CF51-9751-44DE-BA79-53DD2A4FA7E0} S-1-5-21-928733405-3780110381-2966456290-1000:VTILVGXH\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2680
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2480
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD57f6ce9a396cae9d375cb1a56de268b84
SHA14129cc4492f057cc2ec78c195c1badd7ab3d9c65
SHA256604d490b9d5dfff01c9fceb085798c6b42f5778c9f125457be654dc4f436ab04
SHA512e3cfe5afbde8b7889767cd9556ddbff2a3652ab139f06f02ec27cbd638d05604b3cbd5dcc2732a62750ced77d32eeab69b92e7eca38fe434121611c8775c314d