Analysis
-
max time kernel
54s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
20/07/2024, 03:20
General
-
Target
CustomRP.1.17.26.exe
-
Size
6.3MB
-
MD5
b67cce9e674aa1e40173fe8a1fa6f368
-
SHA1
016caf7ad60ba02d7bb3eef533e2ea5cecff1776
-
SHA256
0c7d21aba4eeaa6b8a6dee2cf5d1812067360cebfd176743ca62cf3bf953e379
-
SHA512
f1aa9b50d1cfd3bcad0515d105325529d48e925fb07947ad571b8c3485334c8c9558b6d0ce717d8e6f844487622c33422db4d763416ae05c731b2795d9e73d5c
-
SSDEEP
196608:Ojm0GnDCGLgEpJINUg/DFeZCg86Sb5ZECanMiMscO5KtTHCx7hm:P0GneGLgV+ABecgS9ZECa7BcOot1
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 25 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CustomRP.1.17.26.exe"C:\Users\Admin\AppData\Local\Temp\CustomRP.1.17.26.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SBIKV.tmp\CustomRP.1.17.26.tmp"C:\Users\Admin\AppData\Local\Temp\is-SBIKV.tmp\CustomRP.1.17.26.tmp" /SL5="$6024C,5498303,1081856,C:\Users\Admin\AppData\Local\Temp\CustomRP.1.17.26.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\CustomRP\CustomRP.exe"C:\Users\Admin\AppData\Roaming\CustomRP\CustomRP.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD5f7f67dcd5304161073506073c7aa1a43
SHA15f01a02750bff468b6aaa83e68a1c02108ae374e
SHA256ace58d6d9445a62caa7ec39fb4fdbede5a0b8b0a3f409bcccd1b7650988230da
SHA512d1586c63cb1db0c3d7f129d86ee1ae863443e01eb70a4ead76dad092c30269c3f86783c25a30eadda101993d9c9feed0293ca99cd474651e1605c3576e729f71
-
Filesize
958B
MD5b4cf603bb5b03a18f7ad551f24716d25
SHA1029e0c2146c146f8ed4dd23d793cd470d1fe6b5e
SHA256cdb1f788c41c7567ec65b6552da865e64ed0c3a9eac56107ccecd1ee48ff9def
SHA5128b4b19abcdf4d580747628cf60972d05c0989d581e705ad5c6a10d8e876bc634880709155501616e1faf726696d96efca57fdb18b0d7e7c8639142afd846e487
-
Filesize
454B
MD5ba47aff15216dcd0915ade13a823f2ad
SHA1dddcaa14d8b1ad3c135b264fe034746aca63363b
SHA256044dc224fe8b17561cc5195c162bd5f8b46207c9b89acbcdbc16628cf633bcbd
SHA51246ba460062f7a2c3829624efcd93ff85ad648d1e2a79e5ab1b1f0e06ac940f2652370fb8a0093d88c2abba7319b7878aac50ff4b9d55c0bdbd2174c9abc78ac9
-
Filesize
183B
MD5b684055407f1c6f1a5a4409fcb892032
SHA1bea3ccc460392870b7919405e88628fbd9c415a3
SHA256990269e9c519a337e958051e7d1eac9c679326be41650170c411f40e87a1c066
SHA5126516a57d863b3d93134a2c2144e0e1934287352ba1d222e2093db3cdd605f2a71c9a17dfb9cd46cedf7d54f07be181dace8e9bdb83ce39a211f3caf1a34c1965
-
Filesize
270B
MD5c437185b1531e86a0bdf8fa5ba94270f
SHA1cfe314effcbf9d5fa4c9811b55879fe700c813c0
SHA256a0c52394d3b664e734a15db0908a7c8b16aa2ba8a137d3cd317f3905c47d1519
SHA512fd6685a81e838f875324638ee0463a670da44a78f3b0b4cae6c101e425f079505350aa4a4e36807ff2e73c1045ca63acf40c22f5560b9744ba949413c0bc61e8
-
Filesize
147KB
MD5e39cd45b2e0390c91b34651c7dd0f7d7
SHA1172a00f49e8ddb413ade56d46d10c59830ce9c69
SHA25647c9f22684bae6afd08cdcca386edf8b47fa5e2a749faeb6499dc4b3ca6e5642
SHA512fd25a41efc0e301049b8b19a7b3fc6122cf187045a32514396603a9ba4305a74c115041583fe86b2b581b2523107b2bd440c9a0e3a1b4d96b22ef632d607ae1d
-
Filesize
1.1MB
MD543e80724f03f1456e10e74fbaec1f280
SHA196380cb2645430fe8c61213f9291e3d4657a5742
SHA256877c92562a680f89df6ec74d48a4a9c62685091be7a986590e9b06142deb66ed
SHA51281b366fcce822eed9157e209076dac66a10bbc51e16db6194a389422f451b77b15b51c16bc3207d9ce1436305937835ef90d2d32b035b4e53bd36868ceaa30da
-
Filesize
4KB
MD5b496e0b64ad960a0b13327a350ed89dd
SHA1d84f215a7c6766c60bb27fc59bddafa6069830e1
SHA2564691bf30db39d0cb27f0608e1c01de7865b9e7175667899c0dabc57b91908afb
SHA512b548343b0188adb3c75557722c35d086365ac0a091bef8164a1ee3e52bf7455edbc17fe1d3297e8da117527afa8639de19aa10c875cacd644b5c13725d0727a7
-
Filesize
82KB
MD52e9f2a132f59cde7f3a888f5fa674cfc
SHA1441271e6e1c2a65eb43ac8a76be8d7bf5f0b9a00
SHA25684ef313d2525da8006167fdd8b78556f5038bf1571e3201e619b3d956fe6d842
SHA512dd420ed1cfebb181c5706ebda1f88c267a40a158b5d22a6bea54710add2cee395a6dd67e9e04c96b387db791aea84ea3b124db5e424d8b3a2d5f1b807856534d
-
Filesize
25KB
MD54f0eeea40634e091b149e22d098f0084
SHA18426f3f5a89dd8a32e07c54362a523825cdd4361
SHA25629ce7dd433293977386ae132e3a72b60bf32559f5b56b555166b78953212743e
SHA512415fe0ee2a36ae51420f11afb9d127bc41fba899274be097674059e5b50fc2a5ee206779160191c3cfb2a24f0c4c8799072ab013adae6a557754883066ad847d
-
Filesize
52KB
MD51fb364c1d622905aebd6e57500c169d1
SHA15423fb63ab28a24e1fdef3616e5e0e3301dbbc5f
SHA25607125de19eb06c67010039448e898c7bb954d25cf0a77b05d95329ed575f24e2
SHA512ae724010f049989ec006ce71990073834f8d58ebf1133a589ec3de839acde1c07b136deaf9e237c3b5a3d216ea9dbbc5aaaf482df1b549ee786a7a2e27d6bff8
-
Filesize
145KB
MD5885481ebbec08fa817ada9a5f7a527ad
SHA1c9390ecd62766338584a0ff45c71d6abd64db379
SHA25682e14d7bada761bf353929163bde2cf5c12e41727937ae5f0c7314fcee8be029
SHA5129b2a24f9d30886321e5961d5bd59377a4500bc5f9de23c5a217e94087a8f8742e3754cfaae8d93c6d3bdf7d6b1fa578a103bc6e98571bd201e1dc9564d38ed39
-
Filesize
695KB
MD5715a1fbee4665e99e859eda667fe8034
SHA1e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
-
Filesize
1.3MB
MD53348408f1304e3527c7cdbb21194bdfb
SHA14a90269be013d2bd5bb9fbee5ab4cc5bb21dce51
SHA256609fe5f2d8fb3ee6ccec30c5d355f4d97e89ec3d285b3ae7912d0d1477368a8e
SHA51283afe8465948e448bd9f938610718d762d5eb3793035ceb5f3bc6348107bf0313cc43ff563016e205e2f976962fa3fa7eca71fe8c1d6c880ae812ddf84028d45
-
Filesize
11KB
MD559e7b8c38944a8d591363fb5874dc971
SHA1fdfe99922a4e9aba60ed6b1859ed331bc5940faa
SHA2564ed2707cc2644d63bbd27cf39840aaa4a8617b6b275008f031e16d3a76c75e4b
SHA5125d2d3e138588352267ee8f21d02f7ee6dc9353ce4a22e9fcac56e0016bfcb52ffeb4c530dbd5c6d8d1e2fe0855a50fa909c0b3129eb4fb8e13376f4bfc684f9e
-
Filesize
49KB
MD55e45fcc43a6a54b13e1d384c3c6c6e85
SHA16b54a3602f37ec3b3204914c58fa53f6453ccd3f
SHA256f424dc7b2ac7172e3041ac567603a0cea940fbfded8a2a8df53b2aa22d445da5
SHA5120bb27e39263b2cac625761aeb0db80e4cf43b10573cd8126b250620f82be8508cda948f4dc23693956b39db0af4628f11abd5e28b5b8c6d7a024cf5b30fc7b3f
-
Filesize
63KB
MD5359189a6345d70dcb4703cd4b75b5be4
SHA1afb93196574037c1c84a16892e57766097d579e4
SHA256408749d563fcea1d444ffc35069cc0f9db4c7d10636e08c522b06368e90b5834
SHA5129f729288d4953413abff0884cb88944b579adbb2ea43d49eeae560d0992ee71e9ef072c872e7edf22235e924ad4fbf41ddc063ad4858704cff4cb3166b7c7a22
-
Filesize
138KB
MD5f09441a1ee47fb3e6571a3a448e05baf
SHA13c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA256bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
SHA5120199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
-
Filesize
16KB
MD5da04a75ddc22118ed24e0b53e474805a
SHA12d68c648a6a6371b6046e6c3af09128230e0ad32
SHA25666409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74
SHA51226af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8
-
Filesize
1.2MB
MD5e52a4a0a6f61ec95aa51d8ffd682b72e
SHA16a3529c7ac873131a766415879b20925ff404b64
SHA2567dd2e2923e9a988866d969bb5a76a9d3448a11a0f225b83c734161977db564a5
SHA5120e91687ba8b36cc0a7019ba1bd819f538cd55649914319a074669b7a04fdc9a195d36ba1fd5eeeb6149bffdf46e6dccc6e8d4b8e1cce62aa13463f9410423883
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
728KB
-
Filesize
160KB
-
Filesize
5.6MB
-
Filesize
712KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
152KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
584KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
104KB
-
Filesize
1.2MB
-
Filesize
1.3MB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
1.5MB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB