Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/03/2024, 11:07
General
- Target MEmu-setup-abroad-sdk-mv.exe
- Size 23.0MB
- Sample240303-m79gvsaa45
- SHA256 89174acde0ea21562e6186847ba7d12aacd9b2b2132f456dd8335680daadd9a9
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks for any installed AV software in registry 1 TTPs 2 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 25 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEmu-setup-abroad-sdk-mv.exe"C:\Users\Admin\AppData\Local\Temp\MEmu-setup-abroad-sdk-mv.exe"1⤵
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Product_files\rsStubActivator.exe"C:\Users\Admin\AppData\Local\Temp\Product_files\rsStubActivator.exe" -ip:"dui=6389c80eec3c6ce83d9a2d7e513eb27a0a05ccb4&dit=20240303110849115&is_silent=true&oc=DOT_RAV_Cross_Tri_NCB&p=c52b&a=100&b=&se=true" -vp:"dui=6389c80eec3c6ce83d9a2d7e513eb27a0a05ccb4&dit=20240303110849115&oc=DOT_RAV_Cross_Tri_NCB&p=c52b&a=100&oip=26&ptl=7&dta=true" -dp:"dui=6389c80eec3c6ce83d9a2d7e513eb27a0a05ccb4&dit=20240303110849115&oc=DOT_RAV_Cross_Tri_NCB&p=c52b&a=100" -i -v -d1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qw42lgtc.exe"C:\Users\Admin\AppData\Local\Temp\qw42lgtc.exe" /silent2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsgEB96.tmp\RAVEndPointProtection-installer.exe"C:\Users\Admin\AppData\Local\Temp\nsgEB96.tmp\RAVEndPointProtection-installer.exe" "C:\Users\Admin\AppData\Local\Temp\qw42lgtc.exe" /silent3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:104⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:101⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting.BT1796
Setup.exe.setting.Uh1796
Setup.exe.setting.lock
rsSyncSvc.exe
rsSyncSvc.exe
rsStubActivator.exe
mds.dll
Microsoft.Win32.TaskScheduler.dll
RAVEndPointProtection-installer.exe
rsAtom.dll
rsJSON.dll
rsLogger.dll
rsStubLib.dll
rsSyncSvc.exe
uninstall.ico
System.dll
qw42lgtc.exe
memory/748-2148-0x00000212C3D30000-0x00000212C3D88000-memory.dmp
memory/748-2149-0x00000212A8380000-0x00000212A8381000-memory.dmp
memory/748-1947-0x00000212A9BD0000-0x00000212A9C00000-memory.dmp
memory/748-1911-0x00007FFE74EB0000-0x00007FFE75971000-memory.dmp
memory/748-2066-0x00000212C3360000-0x00000212C339A000-memory.dmp
memory/748-2079-0x00000212A83B0000-0x00000212A83B1000-memory.dmp
memory/748-1860-0x00000212A9B70000-0x00000212A9BB0000-memory.dmp
memory/748-1847-0x00000212A7F50000-0x00000212A7FD8000-memory.dmp
memory/748-2006-0x00000212C33B0000-0x00000212C33C0000-memory.dmp
memory/748-2081-0x00000212A9C70000-0x00000212A9C9A000-memory.dmp
memory/748-2173-0x00000212A8390000-0x00000212A8391000-memory.dmp
memory/748-8900-0x00000212C33B0000-0x00000212C33C0000-memory.dmp
memory/748-8899-0x00007FFE74EB0000-0x00007FFE75971000-memory.dmp
memory/1796-28-0x0000000006F30000-0x0000000006F40000-memory.dmp
memory/1796-25-0x0000000009BA0000-0x0000000009C3C000-memory.dmp
memory/1796-29-0x0000000073160000-0x0000000073910000-memory.dmp
memory/1796-31-0x0000000006F30000-0x0000000006F40000-memory.dmp
memory/1796-20-0x0000000073A00000-0x0000000073A3E000-memory.dmp
memory/1796-647-0x0000000006F30000-0x0000000006F40000-memory.dmp
memory/1796-26-0x0000000009C40000-0x0000000009CA6000-memory.dmp
memory/1796-15-0x0000000006F30000-0x0000000006F40000-memory.dmp
memory/1796-22-0x00000000094F0000-0x0000000009A94000-memory.dmp
memory/1796-30-0x0000000005000000-0x000000000500A000-memory.dmp
memory/1796-19-0x00000000068C0000-0x00000000068FE000-memory.dmp
memory/1796-24-0x0000000009400000-0x0000000009444000-memory.dmp
memory/1796-27-0x000000000A1E0000-0x000000000A70C000-memory.dmp
memory/1796-21-0x0000000073160000-0x0000000073910000-memory.dmp
memory/1796-23-0x0000000006E10000-0x0000000006EA2000-memory.dmp
memory/4640-334-0x00007FFE74EB0000-0x00007FFE75971000-memory.dmp
memory/4640-279-0x00000260916C0000-0x00000260916C8000-memory.dmp
memory/4640-8603-0x0000026091B30000-0x0000026091B40000-memory.dmp
memory/4640-7630-0x00007FFE74EB0000-0x00007FFE75971000-memory.dmp
memory/4640-333-0x00000260AC130000-0x00000260AC658000-memory.dmp