Analysis
-
max time kernel
304s -
max time network
273s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
02-07-2024 09:48
General
-
Target
RPGXP_E.exe
-
Size
27.2MB
-
MD5
4db4691a4f71af97b109b11ee2c70ec9
-
SHA1
ba5eaa22936505df35a10319dbce60ed6e873383
-
SHA256
7f0005d39580ba537d4f9581b47c28adf132a6586d62881a62cd56fa1b24ab27
-
SHA512
2688575f993dd7c2b0bff1634465149103412032bc882d09ccd492033ec94b27c84e4a1655118264728fea358969504ff748a8e6fe73dd313789f2a2d142f15a
-
SSDEEP
786432:F6HKbIBBYy9IMhfpNIubCq9iS2wvX1RA6rxiShm0RML1P:+iI3/9IM6uejAX1RUShT
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
-
Drops file in System32 directory 6 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 16 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RPGXP_E.exe"C:\Users\Admin\AppData\Local\Temp\RPGXP_E.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-M4FS9.tmp\RPGXP_E.tmp"C:\Users\Admin\AppData\Local\Temp\is-M4FS9.tmp\RPGXP_E.tmp" /SL5="$301F4,28152842,118784,C:\Users\Admin\AppData\Local\Temp\RPGXP_E.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-E16HC.tmp\xp_rtp104e.exe"C:\Users\Admin\AppData\Local\Temp\is-E16HC.tmp\xp_rtp104e.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-G4RVC.tmp\xp_rtp104e.tmp"C:\Users\Admin\AppData\Local\Temp\is-G4RVC.tmp\xp_rtp104e.tmp" /SL5="$100068,22729139,53248,C:\Users\Admin\AppData\Local\Temp\is-E16HC.tmp\xp_rtp104e.exe"4⤵
- Drops file in System32 directory
- Drops file in Program Files directory
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:81⤵
-
C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\f4c9625f0cdf46e2b29647ca993a27ec /t 2160 /p 18001⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\ee0255f00e7f4f5ea222d778a2a2056f /t 464 /p 34041⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD56f6ccdccf5bd0946a2b55a014329bdac
SHA148bbe60410e70a991d7ffea90e3e1279ee456c78
SHA256ecb1f0805161e359adedb28b2fa7f8c4d8586d6d5d69a37dd05757618f9e551f
SHA512092d982773dd62e4d6f3a60c83d7e0f7c8ab07afaca3ecfdf960014452e78d4f6437008e8b110993b8e6a798110a736b9be0189f932c348d5b74b23c6cd7b7e1
-
Filesize
8KB
MD5592adc03e205672e8a4f790f685c658f
SHA170e40b322ad187e9860d3619edac25d30624d17f
SHA256aabb33a465c18dcba522190d57100cf3e07107651084275645785625f3f4ff7e
SHA512c21e1eaee0ced3e57e518bc72c87b9cfa615d84d44081e868dcaa4f5fcb95273028a1ebb7854d7feab098973e066a607d586b537b5ad2ac2a04f88e7048ec03e
-
Filesize
644KB
MD52ecb353c8974f1020d1425dfb8d4f591
SHA164b4196b78b4cdba32d8a5f14391861973dbe676
SHA256614ffaa33a9bf1453dbac9033c941aea534cf12fe89f568344d94217497ac674
SHA5120b079efff3c97d059eeed87df6433fc3929f18542d700bbee5c4f32ba5e2e216c68cc8403c2d9224cae2cc92550c7e668b1152586db6b8579f4ddaa8fbbbb9df
-
Filesize
9KB
MD5ffffdaaf9f1c7c47a4761df64f4ee56b
SHA16a3fd89cf56f9341bd872fad778af56f39a418f2
SHA256c4c87ffce5df52d6acf28a94aa5414fd7305d44825394fe4cb809ca20e6bcf54
SHA512b19ddd75a6a6d1dc44e70c30a01c7474bed5eab02d366786ef063be756a4993896038f0a368a00b5e383d639005ecf1f2e0f1d4223133b0b40340f8d777d0c2d
-
Filesize
10KB
MD5ff708a85d46bc03f24dbf1e5119aadab
SHA139882cb9b2c82f8d1fbcefe1e0b0b41acbff5205
SHA256dba7d3497b93f4752169ea3b19ee9a2727aed3dc0f58f722908d77e315851497
SHA512f1869c1f5f46d8d906cbe142aa4f1b08e21ce388265e80622dbc099ecdc1987709a20546f8b33018cfc4806d8c4eda3e1b4ee1f362a77802bc0eb592e30c3fd4
-
Filesize
4KB
MD57f1b95225ec76ae446a9f149bd6124f5
SHA10c0e5c159facd1a075e1b50b013123fab5ad6706
SHA256a90e6a055e9b38788ca782a0641a247b58e857bdd91364ac6248d67497b1c817
SHA512d914061975c0f1debfabe59a0bca8db00a5ac4af96d3f530cbf0cdd02e6e848bc0cff17cddd9436b7d0159671b3e791770b665fafabba89a642304b2b1cd5965
-
Filesize
136B
MD5a07fc8d93e284c277e85d244de843b85
SHA16e88a8e69f95048251f49aa58c661959ebedf7af
SHA2562e0e3be0f10aff26efcb760cab630fecf8a42a39893d21b1a384ac8c4e80e775
SHA512bec9d6e1e5406a6c6047a4c9b11dd4350c799298f4e5749fcfe67da4d22bab071ae8781444d2c150d2b0567c1449f3e451ea3301b5df2ff3e8e2d64fbcf2eafe
-
Filesize
136B
MD54f554ae411dd5f2e0fd576d57f5203a0
SHA1b3f1e1cdbd265532c60036993b5146094accabe4
SHA25625886efd10b8b7262aee633d8204153a83585ea64d5082f97ba2c85df7e043e8
SHA512d790209b0cefc0457c93006253a9016f0b3e35df1a8c4d741c073d6a8657639b27454cf7c02683f0398938b1d8e72e1fd9df722387e8af53f7bd3c197e57035b
-
Filesize
3KB
MD57741ca655eae3de3edd79b3ff5c09091
SHA1e51c78456b97069163d2151bb05b47be9d9063cc
SHA25688e77e4d914a55963121af6ebdeb47adac43ffd5997beb0cfeb20047bb9f6cfc
SHA5128bc9e1e0432942d97d3cb301c5138bf10107ca91d9a613747a645af9a22525ca1d135d64984d7cd4ff7764894cc7b9929dc86ddf4e43ce53156ddf02f23cfabb
-
Filesize
21.9MB
MD5611881d2a5b8825df189616e7a2760f3
SHA12a907a5371d27dbf80cd9efc399fff76109a3968
SHA256b3bd20ad7f413b40ac233aafd2e061de1dc429c2eadb59d0b3157ba3c47f16b2
SHA512d79d8f57f8219574723239c0091068db64d2304e6b7495187247397491371e8761e711d027cab36bd08cbf86a1bf805dfbfeaff910f6b49458ff9c0c5872af23
-
Filesize
1.1MB
MD563b15124be653dbe589c7981da9d397c
SHA1af8874bdf2ad726f5420e8132c10becc2bbcd93c
SHA25661674b90891ca099d5fee62bf063a948a80863530ab6a31e7f9e06f0e5bc7599
SHA512339b284b5dd7386dcfa86c8fdcf239a0e97cc168229ea9a66fc0c6b26771401fa7f27c2c6a435a836a43ea9c7e634a3e47ec77e0d27985794bbb4416dfc97ac8
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
Filesize
156KB
-
Filesize
68KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
