Analysis
-
max time kernel
49s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 17:52
Static task
static1
Behavioral task
behavioral1
Sample
Rec-Net-Importer-Main.rar
Resource
win7-20240508-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Rec-Net-Importer-Main.rar
Resource
win10v2004-20240226-en
6 signatures
150 seconds
General
-
Target
Rec-Net-Importer-Main.rar
-
Size
36B
-
MD5
a1ca4bebcd03fafbe2b06a46a694e29a
-
SHA1
ffc88125007c23ff6711147a12f9bba9c3d197ed
-
SHA256
c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
-
SHA512
6fe1730bf2a6bba058c5e1ef309a69079a6acca45c0dbca4e7d79c877257ac08e460af741459d1e335197cf4de209f2a2997816f2a2a3868b2c8d086ef789b0e
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2032 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
rundll32.exevlc.exepid process 2720 rundll32.exe 2032 vlc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
rundll32.exepid process 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
vlc.exepid process 2032 vlc.exe 2032 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2032 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exerundll32.exerundll32.exedescription pid process target process PID 1740 wrote to memory of 2720 1740 cmd.exe rundll32.exe PID 1740 wrote to memory of 2720 1740 cmd.exe rundll32.exe PID 1740 wrote to memory of 2720 1740 cmd.exe rundll32.exe PID 2720 wrote to memory of 2568 2720 rundll32.exe rundll32.exe PID 2720 wrote to memory of 2568 2720 rundll32.exe rundll32.exe PID 2720 wrote to memory of 2568 2720 rundll32.exe rundll32.exe PID 2568 wrote to memory of 2032 2568 rundll32.exe vlc.exe PID 2568 wrote to memory of 2032 2568 rundll32.exe vlc.exe PID 2568 wrote to memory of 2032 2568 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Rec-Net-Importer-Main.rar1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Rec-Net-Importer-Main.rar2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Rec-Net-Importer-Main.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Rec-Net-Importer-Main.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2032
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1020