Analysis
- max time kernel
360s - max time network
363s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
19/03/2024, 22:08
General
- Target RainwaySetup.exe
- Size 77.5MB
- Sample240319-12pgdsha44
- SHA256 55626f87358dc713199e31869307ffcc9e38a08d7f204b5feb0181f17ea47519
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 24 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RainwaySetup.exe"C:\Users\Admin\AppData\Local\Temp\RainwaySetup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\FeelingEyestrain-Launcher.exeC:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\FeelingEyestrain-Launcher.exe /S2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\javaw.exe"C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\FeelingEyestrain-Launcher.exe" org.develnext.jphp.ext.javafx.FXLauncher /S3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
FeelingEyestrain-Launcher.exe
FeelingEyestrain-Launcher.exe
awt.dll
jvm.dll
glass.dll
javaw.exe
msvcr120.dll
nio.dll
prism_sw.dll
zip.dll
accessibility.properties
currency.data
jfxrt.jar
meta-index
jvm.cfg
jsse.jar
meta-index
resources.jar
rt.jar
java.security
tzdb.dat
tzmappings
FeelingEyestrain-Launcher.exe
FeelingEyestrain-Launcher.exe
FeelingEyestrain-Launcher.exe
awt.dll
jvm.dll
glass.dll
java.dll
javafx_font.dll
msvcp120.dll
msvcr100.dll
msvcr120.dll
net.dll
prism_d3d.dll
prism_sw.dll
verify.dll
NAct.dll
UAC.dll
memory/2120-225-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2300-386-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-284-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-325-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-274-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-273-0x0000000000170000-0x0000000000171000-memory.dmp
memory/2300-271-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-332-0x0000000000170000-0x0000000000171000-memory.dmp
memory/2300-248-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-323-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-322-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-321-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-384-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-388-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-389-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-291-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-391-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-398-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-314-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-277-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-324-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-305-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-413-0x00000000001A0000-0x00000000001AA000-memory.dmp
memory/2300-412-0x00000000001A0000-0x00000000001AA000-memory.dmp
memory/2300-415-0x00000000001A0000-0x00000000001AA000-memory.dmp
memory/2300-421-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-423-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-426-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-434-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-436-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-440-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-287-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-300-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-296-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-444-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-290-0x0000000000170000-0x0000000000171000-memory.dmp
memory/2300-446-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-451-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-452-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-453-0x0000000002920000-0x0000000004920000-memory.dmp
memory/2300-454-0x0000000002920000-0x0000000004920000-memory.dmp