Analysis
-
max time kernel
141s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 10:38
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240611-en
General
-
Target
file.exe
-
Size
4.2MB
-
MD5
39483496950b1a7bbd28617e6006efeb
-
SHA1
d922c857874fd52067791397128e62267cd0cd56
-
SHA256
9e711f696ed3c36e8333a62b6cb8184a715d3a9ce2ff61b60bcd547ce550bf3a
-
SHA512
6443f9a2956b3600aae04c862cf2e070435fe44d6df853cfaa213d097322bcbaffb83af7451d035bd674d72670ff377c46572822f68f61bac78d7f49467df8e2
-
SSDEEP
98304:/j+Am4UGrNsnH/vmbOPRYc43/8ToqX2yV4DyWQOEK5AUvpA3IktHhjWi3Ec:JUGrNsnHGb6T43/8Mu2rTkKiUheIejW4
Malware Config
Extracted
risepro
5.42.66.10
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk file.exe -
Loads dropped DLL 1 IoCs
pid Process 2072 file.exe -
resource yara_rule behavioral1/memory/2072-0-0x0000000000FC0000-0x0000000001B7A000-memory.dmp themida behavioral1/memory/2072-6-0x0000000000FC0000-0x0000000001B7A000-memory.dmp themida behavioral1/memory/2072-4-0x0000000000FC0000-0x0000000001B7A000-memory.dmp themida behavioral1/memory/2072-7-0x0000000000FC0000-0x0000000001B7A000-memory.dmp themida behavioral1/memory/2072-8-0x0000000000FC0000-0x0000000001B7A000-memory.dmp themida behavioral1/memory/2072-10-0x0000000000FC0000-0x0000000001B7A000-memory.dmp themida behavioral1/memory/2072-9-0x0000000000FC0000-0x0000000001B7A000-memory.dmp themida behavioral1/memory/2072-11-0x0000000000FC0000-0x0000000001B7A000-memory.dmp themida behavioral1/files/0x0007000000014219-15.dat themida behavioral1/memory/2072-21-0x0000000000FC0000-0x0000000001B7A000-memory.dmp themida behavioral1/memory/2072-36-0x0000000000FC0000-0x0000000001B7A000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV5 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV5\\ExtreamFanV5.exe" file.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2072 file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2288 schtasks.exe 2320 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2072 file.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2288 2072 file.exe 28 PID 2072 wrote to memory of 2288 2072 file.exe 28 PID 2072 wrote to memory of 2288 2072 file.exe 28 PID 2072 wrote to memory of 2288 2072 file.exe 28 PID 2072 wrote to memory of 2320 2072 file.exe 30 PID 2072 wrote to memory of 2320 2072 file.exe 30 PID 2072 wrote to memory of 2320 2072 file.exe 30 PID 2072 wrote to memory of 2320 2072 file.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
PID:2288
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD539483496950b1a7bbd28617e6006efeb
SHA1d922c857874fd52067791397128e62267cd0cd56
SHA2569e711f696ed3c36e8333a62b6cb8184a715d3a9ce2ff61b60bcd547ce550bf3a
SHA5126443f9a2956b3600aae04c862cf2e070435fe44d6df853cfaa213d097322bcbaffb83af7451d035bd674d72670ff377c46572822f68f61bac78d7f49467df8e2