Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
03/02/2024, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
RvcDownloader.exe
Resource
win10-20231215-en
Behavioral task
behavioral2
Sample
RvcDownloader.exe
Resource
win10v2004-20231215-en
General
-
Target
RvcDownloader.exe
-
Size
1.1MB
-
MD5
7f6ce9a396cae9d375cb1a56de268b84
-
SHA1
4129cc4492f057cc2ec78c195c1badd7ab3d9c65
-
SHA256
604d490b9d5dfff01c9fceb085798c6b42f5778c9f125457be654dc4f436ab04
-
SHA512
e3cfe5afbde8b7889767cd9556ddbff2a3652ab139f06f02ec27cbd638d05604b3cbd5dcc2732a62750ced77d32eeab69b92e7eca38fe434121611c8775c314d
-
SSDEEP
24576:YAKoSJz+0Iw0kyFKLjA4OInTbghKT+5YqyIkIIWV+05rk4o/iq6MH:HCS7wDNjA4OIPiDGqyIkHfy0N
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Executes dropped EXE 4 IoCs
pid Process 4052 Dllhost.exe 3776 Server.exe 4616 Server.exe 2892 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 5 2.tcp.eu.ngrok.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 22 IoCs
pid Process 2124 RvcDownloader.exe 2124 RvcDownloader.exe 4052 Dllhost.exe 4052 Dllhost.exe 4052 Dllhost.exe 3776 Server.exe 3776 Server.exe 4052 Dllhost.exe 4052 Dllhost.exe 4052 Dllhost.exe 4052 Dllhost.exe 4052 Dllhost.exe 4052 Dllhost.exe 4616 Server.exe 4052 Dllhost.exe 4052 Dllhost.exe 4052 Dllhost.exe 4052 Dllhost.exe 4052 Dllhost.exe 4052 Dllhost.exe 2892 Server.exe 2892 Server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3960 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2124 RvcDownloader.exe 4052 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe Token: 33 4052 Dllhost.exe Token: SeIncBasePriorityPrivilege 4052 Dllhost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2124 RvcDownloader.exe 4052 Dllhost.exe 3776 Server.exe 4616 Server.exe 2892 Server.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2124 wrote to memory of 4052 2124 RvcDownloader.exe 73 PID 2124 wrote to memory of 4052 2124 RvcDownloader.exe 73 PID 2124 wrote to memory of 4052 2124 RvcDownloader.exe 73 PID 4052 wrote to memory of 3960 4052 Dllhost.exe 74 PID 4052 wrote to memory of 3960 4052 Dllhost.exe 74 PID 4052 wrote to memory of 3960 4052 Dllhost.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\RvcDownloader.exe"C:\Users\Admin\AppData\Local\Temp\RvcDownloader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
PID:3960
-
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:3776
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4616
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
507B
MD50de4a673c46d192f575c41e7c80ffc3e
SHA17a1da7e8ec2efd904ecb237ebedd4d7a3ee826f1
SHA256c18d0ff8e7b83a8623a8515d91d65f68deef6da9f68d84886864177f45acbf65
SHA512b505619848b2f6038e68a2d7baaa4cf314d39023a5b7a32001262ecda03a905986ac8a45a249745e29637b0acfaba1ae06bfaecc678283a808e6f9f4b455e209
-
Filesize
1.1MB
MD57f6ce9a396cae9d375cb1a56de268b84
SHA14129cc4492f057cc2ec78c195c1badd7ab3d9c65
SHA256604d490b9d5dfff01c9fceb085798c6b42f5778c9f125457be654dc4f436ab04
SHA512e3cfe5afbde8b7889767cd9556ddbff2a3652ab139f06f02ec27cbd638d05604b3cbd5dcc2732a62750ced77d32eeab69b92e7eca38fe434121611c8775c314d