Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3RSMB#.rar
windows11-21h2-x64
3RSMB/Mac/R...ac.dmg
windows11-21h2-x64
3Reel Smart..._store
windows11-21h2-x64
3Reel Smart...n.icns
windows11-21h2-x64
3Reel Smart...e.tiff
windows11-21h2-x64
1Reel Smart...ate#ps
windows11-21h2-x64
3Reel Smart...fo.xml
windows11-21h2-x64
1Reel Smart...RSMB64
windows11-21h2-x64
1Reel Smart...es.xml
windows11-21h2-x64
1Reel Smart...antine
windows11-21h2-x64
3Reel Smart...fo.xml
windows11-21h2-x64
1Reel Smart...antine
windows11-21h2-x64
3Reel Smart...BPro64
windows11-21h2-x64
1Reel Smart...antine
windows11-21h2-x64
3Reel Smart...kgInfo
windows11-21h2-x64
1Reel Smart...4.rsrc
windows11-21h2-x64
3Reel Smart...antine
windows11-21h2-x64
3Reel Smart...antine
windows11-21h2-x64
3Reel Smart...antine
windows11-21h2-x64
3Reel Smart...antine
windows11-21h2-x64
3Reel Smart...fo.xml
windows11-21h2-x64
1Reel Smart...ecIn64
windows11-21h2-x64
1Reel Smart...antine
windows11-21h2-x64
3Reel Smart...antine
windows11-21h2-x64
3Reel Smart...antine
windows11-21h2-x64
3Reel Smart...es.xml
windows11-21h2-x64
1Reel Smart...antine
windows11-21h2-x64
3Reel Smart...antine
windows11-21h2-x64
3Reel Smart...antine
windows11-21h2-x64
3RSMB/Win/R...64.dll
windows11-21h2-x64
1RSMB/Win/R...64.dll
windows11-21h2-x64
1RSMB/Win/R...64.dll
windows11-21h2-x64
1Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
01/05/2024, 23:52
Static task
static1
Behavioral task
behavioral1
Sample
RSMB#.rar
Resource
win11-20240419-en
Behavioral task
behavioral2
Sample
RSMB/Mac/Reel Smart Motion Blur v6_2_1 for Mac.dmg
Resource
win11-20240419-en
Behavioral task
behavioral3
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/.ds_store
Resource
win11-20240426-en
Behavioral task
behavioral4
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/.VolumeIcon.icns
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/.background/backgroundImage.tiff
Resource
win11-20240426-en
Behavioral task
behavioral6
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/Cracks Archive.webloc:com.apple.lastuseddate#ps
Resource
win11-20240419-en
Behavioral task
behavioral7
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMB64.plugin/Contents/Info.xml
Resource
win11-20240419-en
Behavioral task
behavioral8
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMB64.plugin/Contents/MacOS/RSMB64
Resource
win11-20240426-en
Behavioral task
behavioral9
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMB64.plugin/Contents/_CodeSignature/CodeResources.xml
Resource
win11-20240419-en
Behavioral task
behavioral10
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMB64.plugin/Contents:com.apple.quarantine
Resource
win11-20240419-en
Behavioral task
behavioral11
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBPro64.plugin/Contents/Info.xml
Resource
win11-20240419-en
Behavioral task
behavioral12
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBPro64.plugin/Contents/Info.plist:com.apple.quarantine
Resource
win11-20240426-en
Behavioral task
behavioral13
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBPro64.plugin/Contents/MacOS/RSMBPro64
Resource
win11-20240419-en
Behavioral task
behavioral14
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBPro64.plugin/Contents/MacOS/RSMBPro64:com.apple.quarantine
Resource
win11-20240426-en
Behavioral task
behavioral15
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBPro64.plugin/Contents/PkgInfo
Resource
win11-20240426-en
Behavioral task
behavioral16
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBPro64.plugin/Contents/Resources/RSMBPro64.rsrc
Resource
win11-20240419-en
Behavioral task
behavioral17
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBPro64.plugin/Contents/Resources:com.apple.quarantine
Resource
win11-20240426-en
Behavioral task
behavioral18
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBPro64.plugin/Contents/_CodeSignatur.quarantine
Resource
win11-20240419-en
Behavioral task
behavioral19
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBPro64.plugin/Contents/_CodeSignature:com.apple.quarantine
Resource
win11-20240426-en
Behavioral task
behavioral20
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBPro64.plugin/Contents:com.apple.quarantine
Resource
win11-20240419-en
Behavioral task
behavioral21
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBVecIn64.plugin/Contents/Info.xml
Resource
win11-20240426-en
Behavioral task
behavioral22
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBVecIn64.plugin/Contents/MacOS/RSMBVecIn64
Resource
win11-20240426-en
Behavioral task
behavioral23
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBVecIn64.plugin/Contents/MacOS:com.apple.quarantine
Resource
win11-20240419-en
Behavioral task
behavioral24
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBVecIn64.plugin/Contents/PkgInfo:com.apple.quarantine
Resource
win11-20240426-en
Behavioral task
behavioral25
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBVecIn64.plugin/Contents/Resources/R.quarantine
Resource
win11-20240419-en
Behavioral task
behavioral26
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBVecIn64.plugin/Contents/_CodeSignature/CodeResources.xml
Resource
win11-20240419-en
Behavioral task
behavioral27
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBVecIn64.plugin/Contents/_CodeSignature:com.apple.quarantine
Resource
win11-20240426-en
Behavioral task
behavioral28
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE/RSMBVecIn64.plugin:com.apple.quarantine
Resource
win11-20240419-en
Behavioral task
behavioral29
Sample
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/RSMB6AE:com.apple.quarantine
Resource
win11-20240426-en
Behavioral task
behavioral30
Sample
RSMB/Win/RSMB6AE/RSMBProVectorInput_64.dll
Resource
win11-20240419-en
Behavioral task
behavioral31
Sample
RSMB/Win/RSMB6AE/RSMBPro_64.dll
Resource
win11-20240419-en
Behavioral task
behavioral32
Sample
RSMB/Win/RSMB6AE/RSMB_64.dll
Resource
win11-20240426-en
General
-
Target
Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]/.ds_store
-
Size
8KB
-
MD5
861fc4c4e7ce00e08ae1bf73eb2fd888
-
SHA1
96027e7e489175f7412812ef71d006ad86354917
-
SHA256
8ea7930bf2d2209aa5a8ed62953638c93d0d8b480520494419249aaec090f965
-
SHA512
ab9e435ccd03677237a0f86303708f59d99e266c0f69d9eadf2123e38708654700439a8707a75d620ad1af9ad29899a56efe85887cfe0ee69bdba9dc0fa152b5
-
SSDEEP
96:DRTwayrUL2jAHzMLiFMzQTojF+lzyZfS:53TkiFQjjF+pY
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4860 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Reel Smart Motion Blur v6.2.1 for Mac [Monter Group]\.ds_store"1⤵
- Modifies registry class
PID:5004
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4860