Analysis
-
max time kernel
93s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 13:24
Static task
static1
Behavioral task
behavioral1
Sample
rm2k3-install.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
rm2k3-install.exe
Resource
win10v2004-20240221-en
General
-
Target
rm2k3-install.exe
-
Size
29.2MB
-
MD5
ef0586cb6f4f783f30c9f2a920ccf212
-
SHA1
b386f0391f2355fa7b32845cf133d3fa4e105a28
-
SHA256
b37aee201207a0a602d805cc1a5cb5b0c77a0b09a1484f22828d2776376b6495
-
SHA512
d155e9d6d17a7b92450b761fbe9f6b0c7e5051b56e4941c72e8061c1e5309f23997052ee3169430113b3e11cf79a1f8678d7865fad12332a5fc5e28db6d999c9
-
SSDEEP
786432:/xpNblY4nsmn2uwMNXFeBThPa7YFuFnEPYmWP9ZEUg:p7O4sm27MN18EFnG01Y
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2988 INS4873.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4252 wrote to memory of 2988 4252 rm2k3-install.exe 92 PID 4252 wrote to memory of 2988 4252 rm2k3-install.exe 92 PID 4252 wrote to memory of 2988 4252 rm2k3-install.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\rm2k3-install.exe"C:\Users\Admin\AppData\Local\Temp\rm2k3-install.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\INS4873.tmpC:\Users\Admin\AppData\Local\Temp\INS4873.tmp /SL3 $801DE C:\Users\Admin\AppData\Local\Temp\rm2k3-install.exe 30583964 30587378 619522⤵
- Executes dropped EXE
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
377KB
MD5ef80f42a048f92263f758f14b09fa30d
SHA1e250058636dee689d6a935d71c0f462e10457239
SHA256a44707ed7ababc6ca81355e9a6afe0e5095d01f1c72ef7b37681447036da518e
SHA512933b43e14cbb734ff48d9b0b06671f15e458633a4e4d52420dd2eda258fc477ae17183a5d83d47da78272d1d6c7f9ba547729cd846ebec5eaf9963b2fce605ed