Overview
overview
7Static
static
3Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...le.dll
windows11-21h2-x64
1Rail.Route...ne.dll
windows11-21h2-x64
1Rail.Route...in.dll
windows11-21h2-x64
1Rail.Route...ib.dll
windows11-21h2-x64
1Rail.Route...rd.dll
windows11-21h2-x64
1Rail.Route...io.dll
windows11-21h2-x64
1Rail.Route...ed.dll
windows11-21h2-x64
1Rail.Route...io.dll
windows11-21h2-x64
1Rail.Route...64.dll
windows11-21h2-x64
1Rail.Route...64.dll
windows11-21h2-x64
1Rail.Route...44.exe
windows11-21h2-x64
7Rail.Route...64.exe
windows11-21h2-x64
7Rail.Route...64.exe
windows11-21h2-x64
7Rail.Route...42.exe
windows11-21h2-x64
7Rail.Route...43.exe
windows11-21h2-x64
7Rail.Route...86.exe
windows11-21h2-x64
7Rail.Route...62.exe
windows11-21h2-x64
7Rail.Route...63.exe
windows11-21h2-x64
7Rail.Route...64.exe
windows11-21h2-x64
1Rail.Route...er.dll
windows11-21h2-x64
1Analysis
-
max time kernel
128s -
max time network
135s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/02/2024, 17:46
Static task
static1
Behavioral task
behavioral1
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.UnityTestProtocolModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.UnityWebRequestAssetBundleModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.UnityWebRequestAudioModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.UnityWebRequestModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.UnityWebRequestTextureModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.UnityWebRequestWWWModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.VFXModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.VRModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.VehiclesModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.VideoModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.VirtualTexturingModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.WindModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.XRModule.dll
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/UnityEngine.dll
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/modio.UnityPlugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/mscorlib.dll
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Managed/netstandard.dll
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Plugins/x86_64/fmodstudio.dll
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Plugins/x86_64/resonanceaudio.dll
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Plugins/x86_64/steam_api64.dll
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Rail Route_Data/Plugins/x86_64/steam_api64.dll
Resource
win11-20240221-en
Behavioral task
behavioral23
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vc_redist.x644.exe
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vc_redist.x864.exe
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x64.exe
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x642.exe
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x643.exe
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x86.exe
Resource
win11-20240221-en
Behavioral task
behavioral29
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x862.exe
Resource
win11-20240221-en
Behavioral task
behavioral30
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x863.exe
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/UnityCrashHandler64.exe
Resource
win11-20240221-en
Behavioral task
behavioral32
Sample
Rail.Route.v1.19.3/Rail.Route.v1.19.3/UnityPlayer.dll
Resource
win11-20240221-en
General
-
Target
Rail.Route.v1.19.3/Rail.Route.v1.19.3/Redist/vcredist_x643.exe
-
Size
6.9MB
-
MD5
53e6fd636573c63684b1a2aba4b1e19d
-
SHA1
393932f2f2958b9fd8b597ea7db1d82e8dd01318
-
SHA256
11cb1f23472e6636cc2532c82b5584f1a644b37210a8bf4c339d4f19482acf93
-
SHA512
b221f433806cbcede0b57ccd1e75de6d650c7895fec96731bbeb562987b15ba6d629db71cb9cc1f064579ef8ed06ed15fc2bc2014f48e53a5715837cd6e2a8aa
-
SSDEEP
196608:c5oyO3CCT/hBxtVtyUVnmSprzVIY7QKAV:qoywCCT/hXQQlrzF72
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1436 vcredist_x643.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{a2199617-3609-410f-a8e8-e8806c73545b} = "\"C:\\ProgramData\\Package Cache\\{a2199617-3609-410f-a8e8-e8806c73545b}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20240222175308.log\" ignored /burn.runonce" vcredist_x643.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fb1a9eb37f5a4fba0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fb1a9eb30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900fb1a9eb3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfb1a9eb3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fb1a9eb300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v11\Dependents\{a2199617-3609-410f-a8e8-e8806c73545b} vcredist_x643.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditional_amd64,v11\Dependents\{a2199617-3609-410f-a8e8-e8806c73545b} vcredist_x643.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{a2199617-3609-410f-a8e8-e8806c73545b} vcredist_x643.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{a2199617-3609-410f-a8e8-e8806c73545b}\Version = "11.0.61030.0" vcredist_x643.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{a2199617-3609-410f-a8e8-e8806c73545b}\DisplayName = "Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030" vcredist_x643.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimum_amd64,v11 vcredist_x643.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimum_amd64,v11\Dependents\{a2199617-3609-410f-a8e8-e8806c73545b} vcredist_x643.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v11 vcredist_x643.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v11 vcredist_x643.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditional_amd64,v11 vcredist_x643.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v11\Dependents\{a2199617-3609-410f-a8e8-e8806c73545b} vcredist_x643.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeBackupPrivilege 3348 vssvc.exe Token: SeRestorePrivilege 3348 vssvc.exe Token: SeAuditPrivilege 3348 vssvc.exe Token: SeBackupPrivilege 2024 srtasks.exe Token: SeRestorePrivilege 2024 srtasks.exe Token: SeSecurityPrivilege 2024 srtasks.exe Token: SeTakeOwnershipPrivilege 2024 srtasks.exe Token: SeBackupPrivilege 2024 srtasks.exe Token: SeRestorePrivilege 2024 srtasks.exe Token: SeSecurityPrivilege 2024 srtasks.exe Token: SeTakeOwnershipPrivilege 2024 srtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1436 vcredist_x643.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5056 wrote to memory of 1436 5056 vcredist_x643.exe 79 PID 5056 wrote to memory of 1436 5056 vcredist_x643.exe 79 PID 5056 wrote to memory of 1436 5056 vcredist_x643.exe 79 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x643.exe"C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x643.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x643.exe"C:\Users\Admin\AppData\Local\Temp\Rail.Route.v1.19.3\Rail.Route.v1.19.3\Redist\vcredist_x643.exe" -burn.unelevated BurnPipe.{FF7208D9-0363-4090-8455-7AFDFD2ADEB6} {F210A40B-0DB8-44BF-9C4F-48527F1AE71A} 50562⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1436
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
126KB
MD5d7bf29763354eda154aad637017b5483
SHA1dfa7d296bfeecde738ef4708aaabfebec6bc1e48
SHA2567f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
SHA5121c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c
-
Filesize
447KB
MD5dfe2eba61b580da064de8e8b7d22ba34
SHA17db24c2dab99822721cc351eee3c637e01c8afd6
SHA2566e306e8e373529a48dfb41cb5bf797450ec336148d385db37d8e0dd0ad0f80a5
SHA5121b3d47b0c8ab234d4d51136a3fdef005b901598b7fbee5dbbf79dc6828084c2af53764b42550454eaf935cdd440c103e9af72851c9d31156a5bba23a839d6459