Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 17:54
Static task
static1
Behavioral task
behavioral1
Sample
Rec-Net-Importer-Main.rar
Resource
win7-20240611-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Rec-Net-Importer-Main.rar
Resource
win10v2004-20240611-en
3 signatures
150 seconds
General
-
Target
Rec-Net-Importer-Main.rar
-
Size
36B
-
MD5
a1ca4bebcd03fafbe2b06a46a694e29a
-
SHA1
ffc88125007c23ff6711147a12f9bba9c3d197ed
-
SHA256
c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
-
SHA512
6fe1730bf2a6bba058c5e1ef309a69079a6acca45c0dbca4e7d79c877257ac08e460af741459d1e335197cf4de209f2a2997816f2a2a3868b2c8d086ef789b0e
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2700 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 2700 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
vlc.exepid process 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
vlc.exepid process 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe 2700 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2700 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exerundll32.exerundll32.exedescription pid process target process PID 1968 wrote to memory of 2708 1968 cmd.exe rundll32.exe PID 1968 wrote to memory of 2708 1968 cmd.exe rundll32.exe PID 1968 wrote to memory of 2708 1968 cmd.exe rundll32.exe PID 2708 wrote to memory of 2628 2708 rundll32.exe rundll32.exe PID 2708 wrote to memory of 2628 2708 rundll32.exe rundll32.exe PID 2708 wrote to memory of 2628 2708 rundll32.exe rundll32.exe PID 2628 wrote to memory of 2700 2628 rundll32.exe vlc.exe PID 2628 wrote to memory of 2700 2628 rundll32.exe vlc.exe PID 2628 wrote to memory of 2700 2628 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Rec-Net-Importer-Main.rar1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Rec-Net-Importer-Main.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Rec-Net-Importer-Main.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Rec-Net-Importer-Main.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2700
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1028