cd86e1e25ef8dcd4933c9a42052c1e98df0e3eddf85cb14d9f72b5d5fdd694d8

General

Target

V Rising update 1.0.4 - 1.0.6.exe
Size

89.5MB
MD5

48da3c880c4f95cbadc3470a329d6f69
SHA1

5715dc5e7fbd8db883a960ea22fbc49fc33f95a9
SHA256

cd86e1e25ef8dcd4933c9a42052c1e98df0e3eddf85cb14d9f72b5d5fdd694d8
SHA512

3edcc6d0bf97d19ba4d91946963f5f203b0ff1822e1888356d0e38613beb9a52c1e40c12c763f0c899fa3306ccb5eaec2e6e456697497b620b9d92af804f3c7e
SSDEEP

1572864:t0NctgLwo8nu37Ct+WJyixAIcoWbD/jyy62OxfH0ujVBLVFa3REvpywfmJJ9V/3g:/tawoV37NWfAjbjB6RFH0ujVBLVQRERD

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3376	V Rising update 1.0.4 - 1.0.6.tmp

Loads dropped DLL 1 IoCs

pid	Process
3376	V Rising update 1.0.4 - 1.0.6.tmp

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\L:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\P:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\Q:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\R:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\S:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\I:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\J:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\U:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\V:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\O:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\Z:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\A:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\E:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\M:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\T:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\X:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\G:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\H:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\W:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\Y:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\B:	V Rising update 1.0.4 - 1.0.6.tmp
File opened (read-only)	\??\N:	V Rising update 1.0.4 - 1.0.6.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3376	V Rising update 1.0.4 - 1.0.6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3376	2964	V Rising update 1.0.4 - 1.0.6.exe	77
PID 2964 wrote to memory of 3376	2964	V Rising update 1.0.4 - 1.0.6.exe	77
PID 2964 wrote to memory of 3376	2964	V Rising update 1.0.4 - 1.0.6.exe	77

C:\Users\Admin\AppData\Local\Temp\V Rising update 1.0.4 - 1.0.6.exe
"C:\Users\Admin\AppData\Local\Temp\V Rising update 1.0.4 - 1.0.6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\is-2B92R.tmp\V Rising update 1.0.4 - 1.0.6.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2B92R.tmp\V Rising update 1.0.4 - 1.0.6.tmp" /SL5="$40224,93280054,134144,C:\Users\Admin\AppData\Local\Temp\V Rising update 1.0.4 - 1.0.6.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-2B92R.tmp\V Rising update 1.0.4 - 1.0.6.tmp

Filesize
1.1MB

MD5
756c5282619ce3c1be5a0ac504d5731f

SHA1
723808c401ca5a299f8b1b6c95bb539771fb739f

SHA256
ba728c139e77a9c898cef9299f1b9979dc9440aec6cb9b4c6ccca6c293c4cd13

SHA512
5bf8f519bc5d0237517cd1c543780d9df3c91251ae277b2b047c3a515e2c438a4c55f1930991eccd8a5f41d2e2a16c14457aa1b5864db9efa932db0a11e9b65b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E1658.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/2964-1-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2964-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2964-16-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3376-7-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/3376-17-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/3376-25-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing