Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 10:38
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240611-en
General
-
Target
file.exe
-
Size
4.2MB
-
MD5
39483496950b1a7bbd28617e6006efeb
-
SHA1
d922c857874fd52067791397128e62267cd0cd56
-
SHA256
9e711f696ed3c36e8333a62b6cb8184a715d3a9ce2ff61b60bcd547ce550bf3a
-
SHA512
6443f9a2956b3600aae04c862cf2e070435fe44d6df853cfaa213d097322bcbaffb83af7451d035bd674d72670ff377c46572822f68f61bac78d7f49467df8e2
-
SSDEEP
98304:/j+Am4UGrNsnH/vmbOPRYc43/8ToqX2yV4DyWQOEK5AUvpA3IktHhjWi3Ec:JUGrNsnHGb6T43/8Mu2rTkKiUheIejW4
Malware Config
Extracted
risepro
191.101.209.39
5.42.66.10
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe -
Drops startup file 1 IoCs
Processes:
file.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk file.exe -
Processes:
resource yara_rule behavioral2/memory/4064-0-0x0000000000590000-0x000000000114A000-memory.dmp themida behavioral2/memory/4064-10-0x0000000000590000-0x000000000114A000-memory.dmp themida behavioral2/memory/4064-9-0x0000000000590000-0x000000000114A000-memory.dmp themida behavioral2/memory/4064-11-0x0000000000590000-0x000000000114A000-memory.dmp themida behavioral2/memory/4064-7-0x0000000000590000-0x000000000114A000-memory.dmp themida behavioral2/memory/4064-12-0x0000000000590000-0x000000000114A000-memory.dmp themida behavioral2/memory/4064-8-0x0000000000590000-0x000000000114A000-memory.dmp themida C:\ProgramData\WinTrackerSP\WinTrackerSP.exe themida behavioral2/memory/4064-20-0x0000000000590000-0x000000000114A000-memory.dmp themida behavioral2/memory/4064-39-0x0000000000590000-0x000000000114A000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
file.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV5 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV5\\ExtreamFanV5.exe" file.exe -
Processes:
file.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
file.exepid process 4064 file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4824 schtasks.exe 3460 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
file.exepid process 4064 file.exe 4064 file.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
file.exedescription pid process target process PID 4064 wrote to memory of 4824 4064 file.exe schtasks.exe PID 4064 wrote to memory of 4824 4064 file.exe schtasks.exe PID 4064 wrote to memory of 4824 4064 file.exe schtasks.exe PID 4064 wrote to memory of 3460 4064 file.exe schtasks.exe PID 4064 wrote to memory of 3460 4064 file.exe schtasks.exe PID 4064 wrote to memory of 3460 4064 file.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\WinTrackerSP\WinTrackerSP.exeFilesize
4.2MB
MD539483496950b1a7bbd28617e6006efeb
SHA1d922c857874fd52067791397128e62267cd0cd56
SHA2569e711f696ed3c36e8333a62b6cb8184a715d3a9ce2ff61b60bcd547ce550bf3a
SHA5126443f9a2956b3600aae04c862cf2e070435fe44d6df853cfaa213d097322bcbaffb83af7451d035bd674d72670ff377c46572822f68f61bac78d7f49467df8e2
-
memory/4064-7-0x0000000000590000-0x000000000114A000-memory.dmpFilesize
11.7MB
-
memory/4064-3-0x0000000076600000-0x00000000766F0000-memory.dmpFilesize
960KB
-
memory/4064-12-0x0000000000590000-0x000000000114A000-memory.dmpFilesize
11.7MB
-
memory/4064-0-0x0000000000590000-0x000000000114A000-memory.dmpFilesize
11.7MB
-
memory/4064-8-0x0000000000590000-0x000000000114A000-memory.dmpFilesize
11.7MB
-
memory/4064-6-0x0000000076600000-0x00000000766F0000-memory.dmpFilesize
960KB
-
memory/4064-10-0x0000000000590000-0x000000000114A000-memory.dmpFilesize
11.7MB
-
memory/4064-9-0x0000000000590000-0x000000000114A000-memory.dmpFilesize
11.7MB
-
memory/4064-11-0x0000000000590000-0x000000000114A000-memory.dmpFilesize
11.7MB
-
memory/4064-1-0x0000000076620000-0x0000000076621000-memory.dmpFilesize
4KB
-
memory/4064-5-0x0000000076600000-0x00000000766F0000-memory.dmpFilesize
960KB
-
memory/4064-2-0x0000000076600000-0x00000000766F0000-memory.dmpFilesize
960KB
-
memory/4064-4-0x0000000076600000-0x00000000766F0000-memory.dmpFilesize
960KB
-
memory/4064-20-0x0000000000590000-0x000000000114A000-memory.dmpFilesize
11.7MB
-
memory/4064-21-0x0000000076620000-0x0000000076621000-memory.dmpFilesize
4KB
-
memory/4064-22-0x0000000076600000-0x00000000766F0000-memory.dmpFilesize
960KB
-
memory/4064-23-0x0000000076600000-0x00000000766F0000-memory.dmpFilesize
960KB
-
memory/4064-25-0x0000000076600000-0x00000000766F0000-memory.dmpFilesize
960KB
-
memory/4064-26-0x0000000076600000-0x00000000766F0000-memory.dmpFilesize
960KB
-
memory/4064-27-0x0000000076600000-0x00000000766F0000-memory.dmpFilesize
960KB
-
memory/4064-39-0x0000000000590000-0x000000000114A000-memory.dmpFilesize
11.7MB