46f5c8193c48a88e3852a85a3a6a22a178f593b62e9ad955f3fbc5f5bfbccdab

Analysis

max time kernel
23s
max time network
27s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ropro-patcher.exe
Size

5.2MB
MD5

a45a9b8f355e4eba9bb96171f572b3ea
SHA1

87a8a3acad2b65db9e5ef978d795f4f5e3c89ea5
SHA256

46f5c8193c48a88e3852a85a3a6a22a178f593b62e9ad955f3fbc5f5bfbccdab
SHA512

5afa6388c7d1019eb713efaf4e0daf275e65553152cdab8b06ad253278733e7b1b7a84a99cd059c0cde3ed7d20bf9fe5c7eb3bae1cdc403c7f4b02ff1d933d1c
SSDEEP

49152:4ksMKU1of3gRlm2enekEWacjeQrLBNCF2Uw5qfzWfE1KlWNz3005xjYmGklytaj/:4id30+nGHHeecFTZOZaG/L1l3QdQE

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
3	raw.githubusercontent.com

C:\Users\Admin\AppData\Local\Temp\ropro-patcher.exe
"C:\Users\Admin\AppData\Local\Temp\ropro-patcher.exe"
1⤵
PID:1872

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RoPro\_locales\zh_SG\messages.json

Filesize
4KB

MD5
671be8f15414f65774a8ddbe668a8d18

SHA1
bc84bb42cd2f63d99573fb91575361481d90c71c

SHA256
d158d4efddf442b65311bf433aa5449627225ab7632f519589879f355fa883a3

SHA512
4102268aa07d374aa272d5a4fdab90d4b35febc360fd1905167b3e1653de490166a0611ef1af8023548ae9761a2b597978394c2e93a27e029d4c6b04e6e7bf47

Download Submit