a800e519e6989f9500ef24e47cdafe7e9c3aad6f0e808799ca5e86d6c0945a43

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$LOCALAPPDATA/RavenBleuSA/bin/1.0.13.0/$OUTDIR/RavenBleuUninstaller.exe
Size

139KB
MD5

8158d8c4808cbb76e5e3f219df862297
SHA1

9614fc01763dab8cbb9cd93fb551343e52fcee2f
SHA256

d7a703bdc04486fef208e19880d4a5437d2e7dd983d3d722e897ac0e42a5ba4d
SHA512

b103e53f465d365c3cf17fdc395b3bc5c9173703dc40862c873f0081f2e422b72f5e7301b596145483d09ddeb13a855c415e5a1d45ebbe38cc08e1cd7d88e1dd
SSDEEP

3072:nQIURTXJHgueJef7JtOafRypSf3DKr8TStq8duqTe1rXrQX:nsCPG7J34pS2riStq1TxrQX

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3032	Au_.exe

Loads dropped DLL 2 IoCs

pid	Process
2324	RavenBleuUninstaller.exe
3032	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral3/files/0x0005000000018f08-2.dat	nsis_installer_1
behavioral3/files/0x0005000000018f08-2.dat	nsis_installer_2

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3032	Au_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 3032	2324	RavenBleuUninstaller.exe	30
PID 2324 wrote to memory of 3032	2324	RavenBleuUninstaller.exe	30
PID 2324 wrote to memory of 3032	2324	RavenBleuUninstaller.exe	30
PID 2324 wrote to memory of 3032	2324	RavenBleuUninstaller.exe	30

C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.13.0\$OUTDIR\RavenBleuUninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.13.0\$OUTDIR\RavenBleuUninstaller.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.13.0\$OUTDIR\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstA4D9.tmp\Install.dll

Filesize
258KB

MD5
7b915d6227d9f4dfe30b9f979f5976e7

SHA1
6157749d1e4432227d226457b247472f0b9697a8

SHA256
4b74e01dc6fbdf0fad39e6e68a498dfa7708098a87d945ae0da1b8a20fb272cb

SHA512
8f6b3e14a0f505eaf3be21dd1d0ca022e9006bf599d03f0d7cd54c61514b79236f2b3b7333107902b3d72c9ad2a7255b184137c9836b2d0d5ce3ef4459461a88

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
139KB

MD5
8158d8c4808cbb76e5e3f219df862297

SHA1
9614fc01763dab8cbb9cd93fb551343e52fcee2f

SHA256
d7a703bdc04486fef208e19880d4a5437d2e7dd983d3d722e897ac0e42a5ba4d

SHA512
b103e53f465d365c3cf17fdc395b3bc5c9173703dc40862c873f0081f2e422b72f5e7301b596145483d09ddeb13a855c415e5a1d45ebbe38cc08e1cd7d88e1dd

Download Submit