a800e519e6989f9500ef24e47cdafe7e9c3aad6f0e808799ca5e86d6c0945a43

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$LOCALAPPDATA/RavenBleuSA/bin/1.0.13.0/RavenBleuSA.exe
Size

764KB
MD5

995bf4913243264269bdbdf64b51f94b
SHA1

7900da0497452d6ae674a600d8d4d07eb6aca750
SHA256

cb87f79e5c9245b6d361ad598996efd2482f0edbc9fb4ebc6ac1217c1be76234
SHA512

279cdae4bb0adbdc5479f84171077ef7e2a522e84f2c6029c35392c19557844093d49a5f7836a792865ba6a5f6ddad162b521a3fdead5762dd2e5b5e8498dd1d
SSDEEP

12288:Crwkx1c6HZa3XNGB56PKr3WnQMHb/QPT1emBMuv60QxtXi4TadwdIwT2:Crwkv3D56PKr8Z/mT1LBMuvQxUmadvC2

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	RavenBleuSA.exe
File opened (read-only)	\??\m:	RavenBleuSA.exe
File opened (read-only)	\??\w:	RavenBleuSA.exe
File opened (read-only)	\??\i:	RavenBleuSA.exe
File opened (read-only)	\??\j:	RavenBleuSA.exe
File opened (read-only)	\??\n:	RavenBleuSA.exe
File opened (read-only)	\??\q:	RavenBleuSA.exe
File opened (read-only)	\??\u:	RavenBleuSA.exe
File opened (read-only)	\??\e:	RavenBleuSA.exe
File opened (read-only)	\??\g:	RavenBleuSA.exe
File opened (read-only)	\??\h:	RavenBleuSA.exe
File opened (read-only)	\??\o:	RavenBleuSA.exe
File opened (read-only)	\??\s:	RavenBleuSA.exe
File opened (read-only)	\??\v:	RavenBleuSA.exe
File opened (read-only)	\??\y:	RavenBleuSA.exe
File opened (read-only)	\??\l:	RavenBleuSA.exe
File opened (read-only)	\??\p:	RavenBleuSA.exe
File opened (read-only)	\??\r:	RavenBleuSA.exe
File opened (read-only)	\??\t:	RavenBleuSA.exe
File opened (read-only)	\??\x:	RavenBleuSA.exe
File opened (read-only)	\??\z:	RavenBleuSA.exe

C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.13.0\RavenBleuSA.exe
"C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.13.0\RavenBleuSA.exe"
1⤵
- Enumerates connected drives
PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...