Analysis

  • max time kernel
    128s
  • max time network
    135s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22/02/2024, 17:46

General

  • Target

    Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x643.exe

  • Size

    6.9MB

  • MD5

    53e6fd636573c63684b1a2aba4b1e19d

  • SHA1

    393932f2f2958b9fd8b597ea7db1d82e8dd01318

  • SHA256

    11cb1f23472e6636cc2532c82b5584f1a644b37210a8bf4c339d4f19482acf93

  • SHA512

    b221f433806cbcede0b57ccd1e75de6d650c7895fec96731bbeb562987b15ba6d629db71cb9cc1f064579ef8ed06ed15fc2bc2014f48e53a5715837cd6e2a8aa

  • SSDEEP

    196608:c5oyO3CCT/hBxtVtyUVnmSprzVIY7QKAV:qoywCCT/hXQQlrzF72

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x643.exe
    "C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x643.exe"
    1⤵
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x643.exe
      "C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x643.exe" -burn.unelevated BurnPipe.{FF7208D9-0363-4090-8455-7AFDFD2ADEB6} {F210A40B-0DB8-44BF-9C4F-48527F1AE71A} 5056
      2⤵
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      PID:1436
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3348
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2024

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\{a2199617-3609-410f-a8e8-e8806c73545b}\.ba1\logo.png

          Filesize

          1KB

          MD5

          d6bd210f227442b3362493d046cea233

          SHA1

          ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

          SHA256

          335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

          SHA512

          464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

        • C:\Users\Admin\AppData\Local\Temp\{a2199617-3609-410f-a8e8-e8806c73545b}\.ba1\wixstdba.dll

          Filesize

          126KB

          MD5

          d7bf29763354eda154aad637017b5483

          SHA1

          dfa7d296bfeecde738ef4708aaabfebec6bc1e48

          SHA256

          7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93

          SHA512

          1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c

        • C:\Users\Admin\AppData\Local\Temp\{a2199617-3609-410f-a8e8-e8806c73545b}\.be\vcredist_x64.exe

          Filesize

          447KB

          MD5

          dfe2eba61b580da064de8e8b7d22ba34

          SHA1

          7db24c2dab99822721cc351eee3c637e01c8afd6

          SHA256

          6e306e8e373529a48dfb41cb5bf797450ec336148d385db37d8e0dd0ad0f80a5

          SHA512

          1b3d47b0c8ab234d4d51136a3fdef005b901598b7fbee5dbbf79dc6828084c2af53764b42550454eaf935cdd440c103e9af72851c9d31156a5bba23a839d6459