Analysis
-
max time kernel
157s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
RvcDownloader.exe
Resource
win10-20231215-en
Behavioral task
behavioral2
Sample
RvcDownloader.exe
Resource
win10v2004-20231215-en
General
-
Target
RvcDownloader.exe
-
Size
1.1MB
-
MD5
7f6ce9a396cae9d375cb1a56de268b84
-
SHA1
4129cc4492f057cc2ec78c195c1badd7ab3d9c65
-
SHA256
604d490b9d5dfff01c9fceb085798c6b42f5778c9f125457be654dc4f436ab04
-
SHA512
e3cfe5afbde8b7889767cd9556ddbff2a3652ab139f06f02ec27cbd638d05604b3cbd5dcc2732a62750ced77d32eeab69b92e7eca38fe434121611c8775c314d
-
SSDEEP
24576:YAKoSJz+0Iw0kyFKLjA4OInTbghKT+5YqyIkIIWV+05rk4o/iq6MH:HCS7wDNjA4OIPiDGqyIkHfy0N
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation RvcDownloader.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Executes dropped EXE 3 IoCs
pid Process 2544 Dllhost.exe 3084 Server.exe 4868 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 36 2.tcp.eu.ngrok.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
pid Process 2568 RvcDownloader.exe 2568 RvcDownloader.exe 2544 Dllhost.exe 2544 Dllhost.exe 2544 Dllhost.exe 2544 Dllhost.exe 2544 Dllhost.exe 2544 Dllhost.exe 2544 Dllhost.exe 2544 Dllhost.exe 3084 Server.exe 2544 Dllhost.exe 2544 Dllhost.exe 2544 Dllhost.exe 2544 Dllhost.exe 2544 Dllhost.exe 2544 Dllhost.exe 2544 Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1916 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2568 RvcDownloader.exe 2544 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe Token: 33 2544 Dllhost.exe Token: SeIncBasePriorityPrivilege 2544 Dllhost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2568 RvcDownloader.exe 2544 Dllhost.exe 3084 Server.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2544 2568 RvcDownloader.exe 90 PID 2568 wrote to memory of 2544 2568 RvcDownloader.exe 90 PID 2568 wrote to memory of 2544 2568 RvcDownloader.exe 90 PID 2544 wrote to memory of 1916 2544 Dllhost.exe 94 PID 2544 wrote to memory of 1916 2544 Dllhost.exe 94 PID 2544 wrote to memory of 1916 2544 Dllhost.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\RvcDownloader.exe"C:\Users\Admin\AppData\Local\Temp\RvcDownloader.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
PID:1916
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:3084
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
PID:4868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD57f6ce9a396cae9d375cb1a56de268b84
SHA14129cc4492f057cc2ec78c195c1badd7ab3d9c65
SHA256604d490b9d5dfff01c9fceb085798c6b42f5778c9f125457be654dc4f436ab04
SHA512e3cfe5afbde8b7889767cd9556ddbff2a3652ab139f06f02ec27cbd638d05604b3cbd5dcc2732a62750ced77d32eeab69b92e7eca38fe434121611c8775c314d