Overview
overview
7Static
static
3Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...ne.dll
windows11-21h2-x64
1Rail.Route...in.dll
windows11-21h2-x64
1Rail.Route...ib.dll
windows11-21h2-x64
1Rail.Route...rd.dll
windows11-21h2-x64
1Rail.Route...io.dll
windows11-21h2-x64
1Rail.Route...ed.dll
windows11-21h2-x64
1Rail.Route...io.dll
windows11-21h2-x64
1Rail.Route...64.dll
windows11-21h2-x64
1Rail.Route...64.dll
windows11-21h2-x64
1Rail.Route...44.exe
windows11-21h2-x64
7Rail.Route...64.exe
windows11-21h2-x64
7Rail.Route...64.exe
windows11-21h2-x64
7Rail.Route...42.exe
windows11-21h2-x64
7Rail.Route...43.exe
windows11-21h2-x64
7Rail.Route...86.exe
windows11-21h2-x64
7Rail.Route...62.exe
windows11-21h2-x64
7Rail.Route...63.exe
windows11-21h2-x64
7Rail.Route...64.exe
windows11-21h2-x64
1Rail.Route...er.dll
windows11-21h2-x64
1Analysis
-
max time kernel
133s -
max time network
158s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/02/2024, 17:46
Static task
static1
Behavioral task
behavioral1
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.UnityTestProtocolModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.UnityWebRequestAssetBundleModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.UnityWebRequestAudioModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.UnityWebRequestModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.UnityWebRequestTextureModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.UnityWebRequestWWWModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.VFXModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.VRModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.VehiclesModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.VideoModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.VirtualTexturingModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.WindModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.XRModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.dll
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/modio.UnityPlugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/mscorlib.dll
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/netstandard.dll
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Plugins/x86_64/fmodstudio.dll
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Plugins/x86_64/resonanceaudio.dll
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Plugins/x86_64/steam_api64.dll
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Plugins/x86_64/steam_api64.dll
Resource
win11-20240221-en
Behavioral task
behavioral23
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vc_redist.x644.exe
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vc_redist.x864.exe
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x64.exe
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x642.exe
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x643.exe
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x86.exe
Resource
win11-20240221-en
Behavioral task
behavioral29
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x862.exe
Resource
win11-20240221-en
Behavioral task
behavioral30
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x863.exe
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/UnityCrashHandler64.exe
Resource
win11-20240221-en
Behavioral task
behavioral32
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/UnityPlayer.dll
Resource
win11-20240221-en
General
-
Target
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x642.exe
-
Size
6.9MB
-
MD5
e74f5ac8f39ff69dddce07c8e1f7f943
-
SHA1
f283c6f14fea54441697f8d4d1d33cb5a180c20c
-
SHA256
4542bf0e828d4428260b2bc975da5bc25d69c060e54176dac1d14b5567ea67d1
-
SHA512
893ba3836e03dc14e0cb7e3da6af1cdb436dbed4beb948ec7118816e3483bc7c68ef87e5a4b200588a0f8ddedd3a79843c77a7b1ad0cd1d31df64b43066f6ca9
-
SSDEEP
196608:E9OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMEL:rz5x7jLXkmkU4cFe
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 5028 vcredist_x642.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{1a63c099-febd-4eaf-83ad-a82ea4fdac49} = "\"C:\\ProgramData\\Package Cache\\{1a63c099-febd-4eaf-83ad-a82ea4fdac49}\\vcredist_x64.exe\" /burn.runonce" vcredist_x642.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a0a26a5bdad282120000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a0a26a5b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a0a26a5b000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da0a26a5b000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a0a26a5b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{1a63c099-febd-4eaf-83ad-a82ea4fdac49}\Version = "12.0.30501.0" vcredist_x642.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{1a63c099-febd-4eaf-83ad-a82ea4fdac49}\Dependents\{1a63c099-febd-4eaf-83ad-a82ea4fdac49} vcredist_x642.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{1a63c099-febd-4eaf-83ad-a82ea4fdac49} vcredist_x642.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{1a63c099-febd-4eaf-83ad-a82ea4fdac49}\ = "{1a63c099-febd-4eaf-83ad-a82ea4fdac49}" vcredist_x642.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{1a63c099-febd-4eaf-83ad-a82ea4fdac49}\DisplayName = "Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501" vcredist_x642.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{1a63c099-febd-4eaf-83ad-a82ea4fdac49}\Dependents vcredist_x642.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12 vcredist_x642.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Dependents\{1a63c099-febd-4eaf-83ad-a82ea4fdac49} vcredist_x642.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12 vcredist_x642.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12\Dependents\{1a63c099-febd-4eaf-83ad-a82ea4fdac49} vcredist_x642.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeBackupPrivilege 4164 vssvc.exe Token: SeRestorePrivilege 4164 vssvc.exe Token: SeAuditPrivilege 4164 vssvc.exe Token: SeBackupPrivilege 1824 srtasks.exe Token: SeRestorePrivilege 1824 srtasks.exe Token: SeSecurityPrivilege 1824 srtasks.exe Token: SeTakeOwnershipPrivilege 1824 srtasks.exe Token: SeBackupPrivilege 1824 srtasks.exe Token: SeRestorePrivilege 1824 srtasks.exe Token: SeSecurityPrivilege 1824 srtasks.exe Token: SeTakeOwnershipPrivilege 1824 srtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5028 vcredist_x642.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4248 wrote to memory of 5028 4248 vcredist_x642.exe 81 PID 4248 wrote to memory of 5028 4248 vcredist_x642.exe 81 PID 4248 wrote to memory of 5028 4248 vcredist_x642.exe 81 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x642.exe"C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x642.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x642.exe"C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x642.exe" -burn.unelevated BurnPipe.{E3D12D67-373E-488C-A8B6-18791F2C915D} {3A7A27AB-9B76-4255-8C7F-10EE225ADDBC} 42482⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5028
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:1824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
117KB
MD5a52e5220efb60813b31a82d101a97dcb
SHA156e16e4df0944cb07e73a01301886644f062d79b
SHA256e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
SHA512d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
-
Filesize
452KB
MD5b2e7e429bc02bf09eda25f8e159189d3
SHA138eaa08098ba11076349f91bb74ff99d09c9cebd
SHA256c7be60dfc46d3ebfccae152141fdacf20ecc6d1754c5f8bc83abd4a13761f3d5
SHA512517878967663eb5442158903cd3255516a702b1ab662b99769170e8d3d5e3e0d2f106f734fec72ede05f5251f4e3ea4da5a46a34a240a9f15e12fafbe39f0057