4b14895a45058c34fb029d0b867412bba2ba76aceb444f28b3b312b98a5a73df

Resubmissions

14/03/2024, 10:26

240314-mgrjcsbh52 10

14/03/2024, 10:25

240314-mfxc8ahe7z 10

Analysis

max time kernel
18s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rino's Discord Account ToolKit/Rino's Discord Account ToolKit.pdb
Size

37KB
MD5

1b7793d953d507e4485773a501a287b7
SHA1

01e3d15e1ec4a1ea575c2749c5df1adf4d79e7cb
SHA256

afab8369e4387abd8620802be1481df2e5957834aee7d1604b120b2bc63029b1
SHA512

4eba9e46a1e74cf3104fd170a59e0c234c194ce8e9e0f5f56d98afe7a51080433504713ee791090b5f5624f745ab8c145397d5c1e77023c3201c8130f1a785a8
SSDEEP

768:bJlvT/BCXTX2fC4Kr0gC9KKnTSISGf45VjzxlrWcSZY:bJlvT/BCjqSYSy2xlrWcSZY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pdb_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pdb_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.pdb\ = "pdb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pdb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pdb_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pdb_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.pdb	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2700	AcroRd32.exe
2700	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 320	2760	cmd.exe	29
PID 2760 wrote to memory of 320	2760	cmd.exe	29
PID 2760 wrote to memory of 320	2760	cmd.exe	29
PID 320 wrote to memory of 2700	320	rundll32.exe	30
PID 320 wrote to memory of 2700	320	rundll32.exe	30
PID 320 wrote to memory of 2700	320	rundll32.exe	30
PID 320 wrote to memory of 2700	320	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Rino's Discord Account ToolKit\Rino's Discord Account ToolKit.pdb"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Rino's Discord Account ToolKit\Rino's Discord Account ToolKit.pdb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Rino's Discord Account ToolKit\Rino's Discord Account ToolKit.pdb"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3e49789340c82e5eef30bdc0dd6329b7

SHA1
dde245f2829a69eb6f896ee48671fff1401acd29

SHA256
fa7d8bea4b77a19147f968822d7a52dcc36c983ac1d34bfcd2c395a360590d39

SHA512
ce0f943c0b9a6479dd3882a7ea1219c7a9677cdacc858379d92822736f30139bf23e9410e5b8e6a8849ce97c52970e82536beb7b6d2eb4419ecdd36598299791

Download Submit