Analysis
-
max time kernel
342s -
max time network
345s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2024 11:25
Behavioral task
behavioral1
Sample
6692518842cd4_BotClient.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6692518842cd4_BotClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
6692518842cd4_BotClient.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
6692518842cd4_BotClient.exe
Resource
win11-20240709-en
General
-
Target
6692518842cd4_BotClient.exe
-
Size
3.7MB
-
MD5
2ab891d9c6b24c5462e32a0bab3d1fec
-
SHA1
4dbb387d2fce2b47ff3699468590466505ba7554
-
SHA256
6ffd157eb781504eadd72996c2cdbd4881034ffb7f7d2bc4b96d4daa61fb4d86
-
SHA512
0317a30e9e70d0ac8416f14a91119504fc40e9a72ee34d358741ebf820367abb3b18e2c64987f6d86d3c4a8952621aebeca83fa027d66edb456c749e56d42d89
-
SSDEEP
98304:rm3o0QMznQ6mUOAj4H0KikjBY5fgq/crZN:GmMzQ6eAj4HbjBOIkS
Malware Config
Extracted
risepro
194.110.13.70
77.105.133.27
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
6692518842cd4_BotClient.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6692518842cd4_BotClient.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
6692518842cd4_BotClient.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6692518842cd4_BotClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6692518842cd4_BotClient.exe -
Drops startup file 1 IoCs
Processes:
6692518842cd4_BotClient.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk 6692518842cd4_BotClient.exe -
Processes:
resource yara_rule behavioral3/memory/4944-0-0x0000000000460000-0x0000000000DEF000-memory.dmp themida behavioral3/memory/4944-9-0x0000000000460000-0x0000000000DEF000-memory.dmp themida behavioral3/memory/4944-12-0x0000000000460000-0x0000000000DEF000-memory.dmp themida behavioral3/memory/4944-14-0x0000000000460000-0x0000000000DEF000-memory.dmp themida behavioral3/memory/4944-11-0x0000000000460000-0x0000000000DEF000-memory.dmp themida behavioral3/memory/4944-13-0x0000000000460000-0x0000000000DEF000-memory.dmp themida behavioral3/memory/4944-10-0x0000000000460000-0x0000000000DEF000-memory.dmp themida C:\ProgramData\WinTrackerSP\WinTrackerSP.exe themida behavioral3/memory/4944-22-0x0000000000460000-0x0000000000DEF000-memory.dmp themida behavioral3/memory/4944-24-0x0000000000460000-0x0000000000DEF000-memory.dmp themida behavioral3/memory/4944-43-0x0000000000460000-0x0000000000DEF000-memory.dmp themida behavioral3/memory/4944-55-0x0000000000460000-0x0000000000DEF000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6692518842cd4_BotClient.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV5 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV5\\ExtreamFanV5.exe" 6692518842cd4_BotClient.exe -
Processes:
6692518842cd4_BotClient.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6692518842cd4_BotClient.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
6692518842cd4_BotClient.exepid process 4944 6692518842cd4_BotClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 312 schtasks.exe 3700 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6692518842cd4_BotClient.exepid process 4944 6692518842cd4_BotClient.exe 4944 6692518842cd4_BotClient.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6692518842cd4_BotClient.exedescription pid process target process PID 4944 wrote to memory of 312 4944 6692518842cd4_BotClient.exe schtasks.exe PID 4944 wrote to memory of 312 4944 6692518842cd4_BotClient.exe schtasks.exe PID 4944 wrote to memory of 312 4944 6692518842cd4_BotClient.exe schtasks.exe PID 4944 wrote to memory of 3700 4944 6692518842cd4_BotClient.exe schtasks.exe PID 4944 wrote to memory of 3700 4944 6692518842cd4_BotClient.exe schtasks.exe PID 4944 wrote to memory of 3700 4944 6692518842cd4_BotClient.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6692518842cd4_BotClient.exe"C:\Users\Admin\AppData\Local\Temp\6692518842cd4_BotClient.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\WinTrackerSP\WinTrackerSP.exeFilesize
3.7MB
MD52ab891d9c6b24c5462e32a0bab3d1fec
SHA14dbb387d2fce2b47ff3699468590466505ba7554
SHA2566ffd157eb781504eadd72996c2cdbd4881034ffb7f7d2bc4b96d4daa61fb4d86
SHA5120317a30e9e70d0ac8416f14a91119504fc40e9a72ee34d358741ebf820367abb3b18e2c64987f6d86d3c4a8952621aebeca83fa027d66edb456c749e56d42d89
-
memory/4944-11-0x0000000000460000-0x0000000000DEF000-memory.dmpFilesize
9.6MB
-
memory/4944-4-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-10-0x0000000000460000-0x0000000000DEF000-memory.dmpFilesize
9.6MB
-
memory/4944-2-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-1-0x00000000754D0000-0x00000000754D1000-memory.dmpFilesize
4KB
-
memory/4944-7-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-6-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-8-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-9-0x0000000000460000-0x0000000000DEF000-memory.dmpFilesize
9.6MB
-
memory/4944-12-0x0000000000460000-0x0000000000DEF000-memory.dmpFilesize
9.6MB
-
memory/4944-14-0x0000000000460000-0x0000000000DEF000-memory.dmpFilesize
9.6MB
-
memory/4944-0-0x0000000000460000-0x0000000000DEF000-memory.dmpFilesize
9.6MB
-
memory/4944-55-0x0000000000460000-0x0000000000DEF000-memory.dmpFilesize
9.6MB
-
memory/4944-5-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-3-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-22-0x0000000000460000-0x0000000000DEF000-memory.dmpFilesize
9.6MB
-
memory/4944-23-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-25-0x00000000754D0000-0x00000000754D1000-memory.dmpFilesize
4KB
-
memory/4944-24-0x0000000000460000-0x0000000000DEF000-memory.dmpFilesize
9.6MB
-
memory/4944-26-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-27-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-28-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-30-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-31-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/4944-43-0x0000000000460000-0x0000000000DEF000-memory.dmpFilesize
9.6MB
-
memory/4944-13-0x0000000000460000-0x0000000000DEF000-memory.dmpFilesize
9.6MB