Overview
overview
10Static
static
30bd57c625c...1b.exe
windows10-2004-x64
100e85c02906...31.exe
windows10-2004-x64
101ad22f7c20...da.exe
windows10-2004-x64
102f0934382a...84.exe
windows7-x64
102f0934382a...84.exe
windows10-2004-x64
10421c712a06...0d.exe
windows10-2004-x64
104958361c2a...c0.exe
windows10-2004-x64
104ee34ec273...69.exe
windows10-2004-x64
1054ae781e47...0d.exe
windows10-2004-x64
10597fd86cf2...51.exe
windows10-2004-x64
105af8e5b632...c7.exe
windows10-2004-x64
105edd2b7f66...17.exe
windows10-2004-x64
105eee268a87...c9.exe
windows10-2004-x64
1065a4c04d9e...25.exe
windows10-2004-x64
106d2e6d5049...21.exe
windows10-2004-x64
1077dcf40927...b4.exe
windows10-2004-x64
108c279e4e62...12.exe
windows10-2004-x64
108ee3fa55ce...d5.exe
windows10-2004-x64
108efb2f072c...7a.exe
windows10-2004-x64
10a717651d7f...a0.exe
windows10-2004-x64
10cecc5213e2...a1.exe
windows10-2004-x64
10Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 19:03
Static task
static1
Behavioral task
behavioral1
Sample
0bd57c625c8696f13dca81e807695648802ac535fabc2f383ee13c655c34c21b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
0e85c029067c6b16235fdcf9b3b93f0b3aef80462a8991420b61166786a76d31.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
1ad22f7c20ecd9c3f25fef51c4432f8d6609d2a5f951e6a29ab4a3a9b7d2ebda.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
4958361c2a42ff04e4d71bc10a59d5ce9b6fae6d86deb588a01b229caeadf1c0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
4ee34ec273a7f43b89678eff087bf31e1b510415dcbb3ef6c8fcf0c06f036669.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
54ae781e479d4e60bdd8734270b33ab0db93c1543e6f477a3dcc2c93b42f7e0d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
597fd86cf22402c976ac13f554867cf010ab3d5c9bdcf8d817c66e620dce4751.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
5af8e5b632a39ba2220e0edd14997e390e73614f2bbcd55986f62325da0e16c7.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
5eee268a879c07625d7394a82b7c1c9212c1bd08e2f22fd5b294cc02b2f31cc9.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
65a4c04d9eef0d0db884e244647345959a2f576dab0d856bc052140c13b17025.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
6d2e6d5049e4da686813824edc4aa0a843fff13079a0a9399739fe64efcfd021.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
77dcf409276e0e91ce08daea19f8477d18c5dba52a0ecbb55c40bc98744973b4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
8ee3fa55ceed18988822ea9dd7e193a1c7e306b0010f172aee42ec3ddd3b2cd5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
8efb2f072c814649d82dcf129f78158d28b7ec827dd8deeccf8e21e23771ae7a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
a717651d7fa6766bf2853b11671e7a5465fd6b8d88661bb92df08a819e765da0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
cecc5213e25a8a2dfe40b0f517d513ce319f2cdf28bcc26df3130a53a46d79a1.exe
Resource
win10v2004-20240508-en
General
-
Target
8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe
-
Size
1.1MB
-
MD5
ed888651c68b1cf8488cc0699d2f7743
-
SHA1
421586dcebb5d402b53e5153cd497d760f82f4ac
-
SHA256
8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212
-
SHA512
ef84d57aefe109f83fd4040acbe53bfda3b5b384f6d2b2794b907713f7f70d40796a6ab349a0cd938752edcf8b31b61804ab6913183b13b390f0ec5397519207
-
SSDEEP
24576:5ykxqe6jmiTbMFiMOTLwaPKQnA+S2gZlH2:skAfM0MOgXxLH
Malware Config
Extracted
risepro
193.233.132.51
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
.NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral17/memory/3856-17-0x00000000025B0000-0x00000000025CC000-memory.dmp net_reactor behavioral17/memory/3856-19-0x0000000002670000-0x000000000268A000-memory.dmp net_reactor -
Executes dropped EXE 2 IoCs
pid Process 2140 1bY74OI8.exe 3856 3op33xW.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1004 2140 WerFault.exe 91 -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2140 1432 8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe 91 PID 1432 wrote to memory of 2140 1432 8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe 91 PID 1432 wrote to memory of 2140 1432 8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe 91 PID 1432 wrote to memory of 3856 1432 8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe 95 PID 1432 wrote to memory of 3856 1432 8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe 95 PID 1432 wrote to memory of 3856 1432 8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe"C:\Users\Admin\AppData\Local\Temp\8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1bY74OI8.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1bY74OI8.exe2⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 6323⤵
- Program crash
PID:1004
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3op33xW.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3op33xW.exe2⤵
- Executes dropped EXE
PID:3856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2140 -ip 21401⤵PID:5024
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
934KB
MD56eb84333807c5944dc621f5f0d1f2445
SHA1bee304d55c583a8cd9edb6a3b89d13fa6d209e02
SHA256ba692868229a98851f79b89e88f2e612d73b53a5390aa14a2f44eb85542f2f47
SHA5122fdd8d2d0c5b4400bcd86c34b34f276578052d6292bce6f1104eee9ae35187bd135bf917fa7242cd6ed0829735cb670fe5314356d2aa5eb8981cd5c559f2d763
-
Filesize
182KB
MD5d0e5ea126f0d61af6672812e973e7611
SHA136b9bee76f643fa039250dafdd8518fc9edc016d
SHA2564594b06362167aa354e71617d6a8e9478ac7856d1b02dacd96e1b1d78427e880
SHA512a7f923ee550722fbf60ded663485789416419d88b809b59525ffea59d5b252effede922c93ae46e8b448a0bbbbd6c805a24fe64d0f6a8c3c82dc08d3dfa499ce