Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2024, 15:56

General

  • Target

    RvcDownloader.exe

  • Size

    1.1MB

  • MD5

    7f6ce9a396cae9d375cb1a56de268b84

  • SHA1

    4129cc4492f057cc2ec78c195c1badd7ab3d9c65

  • SHA256

    604d490b9d5dfff01c9fceb085798c6b42f5778c9f125457be654dc4f436ab04

  • SHA512

    e3cfe5afbde8b7889767cd9556ddbff2a3652ab139f06f02ec27cbd638d05604b3cbd5dcc2732a62750ced77d32eeab69b92e7eca38fe434121611c8775c314d

  • SSDEEP

    24576:YAKoSJz+0Iw0kyFKLjA4OInTbghKT+5YqyIkIIWV+05rk4o/iq6MH:HCS7wDNjA4OIPiDGqyIkHfy0N

Malware Config

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RvcDownloader.exe
    "C:\Users\Admin\AppData\Local\Temp\RvcDownloader.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Users\Admin\AppData\Local\Temp\Dllhost.exe
      "C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
        3⤵
        • Creates scheduled task(s)
        PID:2892
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Drops startup file
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2760
  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    C:\Users\Admin\AppData\Local\Temp/Server.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetWindowsHookEx
    PID:3560
  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Program Files (x86)\Windows Media Player\setup_wm.exe
      "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
      2⤵
        PID:4572
      • C:\Windows\SysWOW64\unregmp2.exe
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:208
        • C:\Windows\system32\unregmp2.exe
          "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
          3⤵
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          PID:1548
    • C:\Users\Admin\AppData\Local\Temp\Server.exe
      C:\Users\Admin\AppData\Local\Temp/Server.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetWindowsHookEx
      PID:656
    • C:\Users\Admin\AppData\Local\Temp\Server.exe
      C:\Users\Admin\AppData\Local\Temp/Server.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetWindowsHookEx
      PID:5040

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Server.exe.log

            Filesize

            507B

            MD5

            25d1b50e7c0d451f3d850eb54d27ca05

            SHA1

            a238807715c70a335f54e80d4855644b21a9e870

            SHA256

            650faa13e983c9046c9030f63a5fa1c33900432ec7cb3762e015da2e7c5b34a5

            SHA512

            4223a26b2fabefdf1c01443ccc7bd887464d27f02694379895a040c66db472d541218d501f1c01e1bd31012d079a31baf24e20882c32cf652a09a74e3bf385f5

          • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

            Filesize

            64KB

            MD5

            fc240c081ec382df4b74d591d7d37a45

            SHA1

            396e9d8accb2ff8b32e6c3957808cb87d23ad47c

            SHA256

            8cfeb277627a0fc9f2596c83dc37f9a3d8871293cd88dadd08f32098bf936038

            SHA512

            d8f83773c330b88b43f9ebc6220aa98368854e44a75b73a8575e7171f6c32e784d404e5a2e2e7787d3c71c0cfecdbb983631b639d9fee879b374d498d2ef0ab7

          • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

            Filesize

            9KB

            MD5

            7050d5ae8acfbe560fa11073fef8185d

            SHA1

            5bc38e77ff06785fe0aec5a345c4ccd15752560e

            SHA256

            cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

            SHA512

            a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

          • C:\Users\Admin\AppData\Local\Temp\Dllhost.exe

            Filesize

            1.1MB

            MD5

            7f6ce9a396cae9d375cb1a56de268b84

            SHA1

            4129cc4492f057cc2ec78c195c1badd7ab3d9c65

            SHA256

            604d490b9d5dfff01c9fceb085798c6b42f5778c9f125457be654dc4f436ab04

            SHA512

            e3cfe5afbde8b7889767cd9556ddbff2a3652ab139f06f02ec27cbd638d05604b3cbd5dcc2732a62750ced77d32eeab69b92e7eca38fe434121611c8775c314d

          • C:\Users\Admin\AppData\Local\Temp\Dllhost.exe

            Filesize

            192KB

            MD5

            f41faa9212ef320eb6ed1aeac222ab93

            SHA1

            1c111b75d430e33aeba08666664e4fa0930ed463

            SHA256

            575ae4898ca0e80cca0e88c595d96ca20501cdfc3bd3908e8bc8d546e70718a4

            SHA512

            d1c8709b64ba7b76477bb2d20185603f4aa0fc9eeb538339f64f6f2e979d540f43f0c06ae0cecf7a1b236a4c1ef6c836308d6b872ea35783efb38e1cf6105d4b

          • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

            Filesize

            1KB

            MD5

            6598555afb4ddb6dd093adadce301469

            SHA1

            fce7ec371800175602a615abf24469abf6073c8a

            SHA256

            b4906cebbf6d4ebeddab263c7c32fea23ed13a9cb8204162f72e196f13b424eb

            SHA512

            7b30ea0edaa4d281c1176506ebbdd659c51473b64aac61c444aa09b40264d4112ed5ae88796ccd98ec89d94bd33f05839f793b818858c62d275ae8c8e864147a

          • memory/656-104-0x0000000000C60000-0x0000000000FD4000-memory.dmp

            Filesize

            3.5MB

          • memory/656-106-0x0000000074A00000-0x00000000751B0000-memory.dmp

            Filesize

            7.7MB

          • memory/656-111-0x0000000074A00000-0x00000000751B0000-memory.dmp

            Filesize

            7.7MB

          • memory/656-110-0x0000000000C60000-0x0000000000FD4000-memory.dmp

            Filesize

            3.5MB

          • memory/656-108-0x0000000005E30000-0x0000000005E40000-memory.dmp

            Filesize

            64KB

          • memory/656-107-0x0000000000C60000-0x0000000000FD4000-memory.dmp

            Filesize

            3.5MB

          • memory/1616-94-0x0000000018990000-0x000000001899C000-memory.dmp

            Filesize

            48KB

          • memory/1616-30-0x00000000000A0000-0x0000000000414000-memory.dmp

            Filesize

            3.5MB

          • memory/1616-52-0x00000000000A0000-0x0000000000414000-memory.dmp

            Filesize

            3.5MB

          • memory/1616-95-0x0000000005500000-0x0000000005510000-memory.dmp

            Filesize

            64KB

          • memory/1616-96-0x0000000005500000-0x0000000005510000-memory.dmp

            Filesize

            64KB

          • memory/1616-100-0x0000000005500000-0x0000000005510000-memory.dmp

            Filesize

            64KB

          • memory/1616-101-0x0000000005500000-0x0000000005510000-memory.dmp

            Filesize

            64KB

          • memory/1616-92-0x0000000006AF0000-0x0000000006AFA000-memory.dmp

            Filesize

            40KB

          • memory/1616-56-0x00000000068B0000-0x00000000068C8000-memory.dmp

            Filesize

            96KB

          • memory/1616-55-0x0000000005830000-0x0000000005896000-memory.dmp

            Filesize

            408KB

          • memory/1616-33-0x00000000000A0000-0x0000000000414000-memory.dmp

            Filesize

            3.5MB

          • memory/1616-34-0x0000000074A00000-0x00000000751B0000-memory.dmp

            Filesize

            7.7MB

          • memory/1616-35-0x00000000000A0000-0x0000000000414000-memory.dmp

            Filesize

            3.5MB

          • memory/1616-36-0x0000000005500000-0x0000000005510000-memory.dmp

            Filesize

            64KB

          • memory/1616-54-0x00000000054E0000-0x00000000054EA000-memory.dmp

            Filesize

            40KB

          • memory/1616-53-0x0000000074A00000-0x00000000751B0000-memory.dmp

            Filesize

            7.7MB

          • memory/2760-18-0x000001F5B16C0000-0x000001F5B16C1000-memory.dmp

            Filesize

            4KB

          • memory/2760-19-0x000001F5B16C0000-0x000001F5B16C1000-memory.dmp

            Filesize

            4KB

          • memory/2760-7-0x000001F5B16C0000-0x000001F5B16C1000-memory.dmp

            Filesize

            4KB

          • memory/2760-8-0x000001F5B16C0000-0x000001F5B16C1000-memory.dmp

            Filesize

            4KB

          • memory/2760-9-0x000001F5B16C0000-0x000001F5B16C1000-memory.dmp

            Filesize

            4KB

          • memory/2760-13-0x000001F5B16C0000-0x000001F5B16C1000-memory.dmp

            Filesize

            4KB

          • memory/2760-14-0x000001F5B16C0000-0x000001F5B16C1000-memory.dmp

            Filesize

            4KB

          • memory/2760-15-0x000001F5B16C0000-0x000001F5B16C1000-memory.dmp

            Filesize

            4KB

          • memory/2760-16-0x000001F5B16C0000-0x000001F5B16C1000-memory.dmp

            Filesize

            4KB

          • memory/2760-17-0x000001F5B16C0000-0x000001F5B16C1000-memory.dmp

            Filesize

            4KB

          • memory/3100-31-0x0000000000220000-0x0000000000594000-memory.dmp

            Filesize

            3.5MB

          • memory/3100-6-0x0000000005A90000-0x0000000005B22000-memory.dmp

            Filesize

            584KB

          • memory/3100-2-0x0000000074A00000-0x00000000751B0000-memory.dmp

            Filesize

            7.7MB

          • memory/3100-32-0x0000000074A00000-0x00000000751B0000-memory.dmp

            Filesize

            7.7MB

          • memory/3100-1-0x0000000000220000-0x0000000000594000-memory.dmp

            Filesize

            3.5MB

          • memory/3100-3-0x0000000005750000-0x00000000057EC000-memory.dmp

            Filesize

            624KB

          • memory/3100-0-0x0000000000220000-0x0000000000594000-memory.dmp

            Filesize

            3.5MB

          • memory/3100-4-0x0000000002F40000-0x0000000002F50000-memory.dmp

            Filesize

            64KB

          • memory/3100-5-0x0000000005FA0000-0x0000000006544000-memory.dmp

            Filesize

            5.6MB

          • memory/3560-45-0x0000000000C60000-0x0000000000FD4000-memory.dmp

            Filesize

            3.5MB

          • memory/3560-47-0x0000000005D00000-0x0000000005D10000-memory.dmp

            Filesize

            64KB

          • memory/3560-50-0x0000000000C60000-0x0000000000FD4000-memory.dmp

            Filesize

            3.5MB

          • memory/3560-51-0x0000000074A00000-0x00000000751B0000-memory.dmp

            Filesize

            7.7MB

          • memory/3560-44-0x0000000074A00000-0x00000000751B0000-memory.dmp

            Filesize

            7.7MB

          • memory/3560-43-0x0000000000C60000-0x0000000000FD4000-memory.dmp

            Filesize

            3.5MB

          • memory/3560-46-0x0000000000C60000-0x0000000000FD4000-memory.dmp

            Filesize

            3.5MB

          • memory/5040-119-0x0000000000C60000-0x0000000000FD4000-memory.dmp

            Filesize

            3.5MB

          • memory/5040-120-0x0000000074A00000-0x00000000751B0000-memory.dmp

            Filesize

            7.7MB

          • memory/5040-121-0x0000000000C60000-0x0000000000FD4000-memory.dmp

            Filesize

            3.5MB

          • memory/5040-122-0x0000000000C60000-0x0000000000FD4000-memory.dmp

            Filesize

            3.5MB

          • memory/5040-123-0x00000000060A0000-0x00000000060B0000-memory.dmp

            Filesize

            64KB

          • memory/5040-125-0x0000000000C60000-0x0000000000FD4000-memory.dmp

            Filesize

            3.5MB

          • memory/5040-126-0x0000000074A00000-0x00000000751B0000-memory.dmp

            Filesize

            7.7MB