Analysis
-
max time kernel
111s -
max time network
113s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14-05-2024 13:39
Errors
General
-
Target
RPGXP_E.exe
-
Size
27.2MB
-
MD5
4db4691a4f71af97b109b11ee2c70ec9
-
SHA1
ba5eaa22936505df35a10319dbce60ed6e873383
-
SHA256
7f0005d39580ba537d4f9581b47c28adf132a6586d62881a62cd56fa1b24ab27
-
SHA512
2688575f993dd7c2b0bff1634465149103412032bc882d09ccd492033ec94b27c84e4a1655118264728fea358969504ff748a8e6fe73dd313789f2a2d142f15a
-
SSDEEP
786432:F6HKbIBBYy9IMhfpNIubCq9iS2wvX1RA6rxiShm0RML1P:+iI3/9IM6uejAX1RUShT
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 7 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Program Files directory 38 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 9 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RPGXP_E.exe"C:\Users\Admin\AppData\Local\Temp\RPGXP_E.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NJ3V0.tmp\RPGXP_E.tmp"C:\Users\Admin\AppData\Local\Temp\is-NJ3V0.tmp\RPGXP_E.tmp" /SL5="$5001C,28152842,118784,C:\Users\Admin\AppData\Local\Temp\RPGXP_E.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DeviceDisplayObjectProvider.exeC:\Windows\system32\DeviceDisplayObjectProvider.exe -Embedding1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5592adc03e205672e8a4f790f685c658f
SHA170e40b322ad187e9860d3619edac25d30624d17f
SHA256aabb33a465c18dcba522190d57100cf3e07107651084275645785625f3f4ff7e
SHA512c21e1eaee0ced3e57e518bc72c87b9cfa615d84d44081e868dcaa4f5fcb95273028a1ebb7854d7feab098973e066a607d586b537b5ad2ac2a04f88e7048ec03e
-
Filesize
644KB
MD52ecb353c8974f1020d1425dfb8d4f591
SHA164b4196b78b4cdba32d8a5f14391861973dbe676
SHA256614ffaa33a9bf1453dbac9033c941aea534cf12fe89f568344d94217497ac674
SHA5120b079efff3c97d059eeed87df6433fc3929f18542d700bbee5c4f32ba5e2e216c68cc8403c2d9224cae2cc92550c7e668b1152586db6b8579f4ddaa8fbbbb9df
-
Filesize
9KB
MD5ffffdaaf9f1c7c47a4761df64f4ee56b
SHA16a3fd89cf56f9341bd872fad778af56f39a418f2
SHA256c4c87ffce5df52d6acf28a94aa5414fd7305d44825394fe4cb809ca20e6bcf54
SHA512b19ddd75a6a6d1dc44e70c30a01c7474bed5eab02d366786ef063be756a4993896038f0a368a00b5e383d639005ecf1f2e0f1d4223133b0b40340f8d777d0c2d
-
Filesize
8KB
MD5f09d55b8cf19610a2627e06dd0952856
SHA1f8835c697d15c03efeb30cd14fe707ec30fb2675
SHA256d7fe0116348622b63511cd0527c00914797ac4689e1ac5473b585ed9760aaf14
SHA5127807cb81efa99c328e5eaf138a1d4d17d15c1f103645ced91cd3afaddc38316d9c71d4b1fc61ece995d6e61c7f37b458c6f78c32d692bb58c69c79e8382756c9
-
Filesize
10KB
MD5ff708a85d46bc03f24dbf1e5119aadab
SHA139882cb9b2c82f8d1fbcefe1e0b0b41acbff5205
SHA256dba7d3497b93f4752169ea3b19ee9a2727aed3dc0f58f722908d77e315851497
SHA512f1869c1f5f46d8d906cbe142aa4f1b08e21ce388265e80622dbc099ecdc1987709a20546f8b33018cfc4806d8c4eda3e1b4ee1f362a77802bc0eb592e30c3fd4
-
Filesize
4KB
MD57f1b95225ec76ae446a9f149bd6124f5
SHA10c0e5c159facd1a075e1b50b013123fab5ad6706
SHA256a90e6a055e9b38788ca782a0641a247b58e857bdd91364ac6248d67497b1c817
SHA512d914061975c0f1debfabe59a0bca8db00a5ac4af96d3f530cbf0cdd02e6e848bc0cff17cddd9436b7d0159671b3e791770b665fafabba89a642304b2b1cd5965
-
Filesize
9KB
MD5874f7d1c5dbc62eca93226a0a0d1b69e
SHA1f991c2694e7ad66fef7fedfaf9d5570b06ca52fa
SHA2569e79ac74da3139c652e8008255d8a19e13c85d0e0347cb173c31d2765e831810
SHA512fc88aafe33f09022afe9caabe7d749526444f9f000f0f8ab0998cc395959d0057f8209e1ad520c5be829b0f2e1d0fb3cc4db3892ac987205ef11828d3afa8403
-
Filesize
136B
MD5c507d9b9d1d9d26c9bb777e28d2fe6a7
SHA175050c2af19a64646a18908d866f4e069f24eee4
SHA25657975936e20349cbc05fa92924eab8214b4144e3d7ed6ded974c0f73770a954c
SHA5121924245d8a00e2d1d2b66d71c4e1373a68382a58e4f585ca0e20f5525424bd32139e7b76b16e29c7a2176d5f4d29a2b684a5c410f1c8376f86d184105451b04f
-
Filesize
3KB
MD5d47b668e67c6e9343f382ac0e00fbc53
SHA164f4d221ec75116046f49bd032d8e81af8f0ae04
SHA256ff7f3918d3408e9af97cfa83c93fc0f14c1f248f2ebf9884141afba789f2e678
SHA512d769d0a0a78961ec6af2b99cfdd73da9195d05fd2349a6f928a7fef1b7e0f09bd1de6c29ab2b26acfdb0b2b5b0b9c82b562dcd450df8dab00e24301275e6e02d
-
Filesize
3KB
MD5acc185e37b1b6e96166dac57977fceb5
SHA1462c226353c8ac5cb78029b034173673427411db
SHA256f973c2d4eefa79ce8ea3783b169a5e9e0846923c5041ff80011c420a836257fe
SHA51253a8c8593704cd578466f48251f392c32bb26070b3294007e898702f8b4c61be323bba9653566b14d584d059491b152329e916fd5c90be58c21283e15aff312d
-
Filesize
740KB
MD571354278675a4deea20fb3cbb5f77170
SHA1073e9f1db6c1be847f186553e985e35e4de03c70
SHA2567b6acb5e2c245b8cfda77fced2cc0e94108384cd1b9ffc8510e7304fcb9feb6c
SHA512e664f02f2d2918c30a6fb75ab7dfe22ab0f2eea8e7ebbcd5b211463062744e51e3956d320127570db0b5dc9c12fb39c6b204bc2967bd4708bccab17d5c980915
-
Filesize
3.2MB
MD56f6ccdccf5bd0946a2b55a014329bdac
SHA148bbe60410e70a991d7ffea90e3e1279ee456c78
SHA256ecb1f0805161e359adedb28b2fa7f8c4d8586d6d5d69a37dd05757618f9e551f
SHA512092d982773dd62e4d6f3a60c83d7e0f7c8ab07afaca3ecfdf960014452e78d4f6437008e8b110993b8e6a798110a736b9be0189f932c348d5b74b23c6cd7b7e1
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.1MB
MD563b15124be653dbe589c7981da9d397c
SHA1af8874bdf2ad726f5420e8132c10becc2bbcd93c
SHA25661674b90891ca099d5fee62bf063a948a80863530ab6a31e7f9e06f0e5bc7599
SHA512339b284b5dd7386dcfa86c8fdcf239a0e97cc168229ea9a66fc0c6b26771401fa7f27c2c6a435a836a43ea9c7e634a3e47ec77e0d27985794bbb4416dfc97ac8
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
68KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
