Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2024 11:42
Behavioral task
behavioral1
Sample
RosConsole/RosConsole.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
RosConsole/RosConsole.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
RosConsole/data/Roshelp.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
RosConsole/data/Roshelp.exe
Resource
win10v2004-20240802-en
General
-
Target
RosConsole/RosConsole.exe
-
Size
10.6MB
-
MD5
901bfaec42f6e7695f5ee1b31f5072ae
-
SHA1
77ada23327779b81f4e64e2645aab9728bb8504e
-
SHA256
79ae5c644a198c68c0d4514ddbdbb840a6638a133b60f73456e598c58f1c6798
-
SHA512
b812b903d9b0baae7dd6b8f38e1348e86c30cdc28f55a2f3750d0f5c07cbe3904afbba8b6d5637be0b4ca202fbd52b9df48d8464a56fa924858af48627691a18
-
SSDEEP
196608:+qyqwuLlA1HeT39IigJ1ncKOVVthIUo0W8/Lo79u5Y3LQd7JZtQcNPOP:Opr1+TtIi00VNRW8E5u6sRP6N
Malware Config
Signatures
-
Enumerates VirtualBox DLL files 2 TTPs 6 IoCs
Processes:
RosHelp.exeRosHelper.exeRosHelp.exedescription ioc Process File opened (read-only) C:\windows\system32\vboxhook.dll RosHelp.exe File opened (read-only) C:\windows\system32\vboxmrxnp.dll RosHelp.exe File opened (read-only) C:\windows\system32\vboxhook.dll RosHelper.exe File opened (read-only) C:\windows\system32\vboxmrxnp.dll RosHelper.exe File opened (read-only) C:\windows\system32\vboxhook.dll RosHelp.exe File opened (read-only) C:\windows\system32\vboxmrxnp.dll RosHelp.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid Process 5088 powershell.exe 5048 powershell.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Executes dropped EXE 2 IoCs
Processes:
RosHelper.exeRosHelper.exepid Process 3908 RosHelper.exe 4332 RosHelper.exe -
Loads dropped DLL 64 IoCs
Processes:
RosConsole.exeRosHelp.exepid Process 404 RosConsole.exe 404 RosConsole.exe 404 RosConsole.exe 404 RosConsole.exe 404 RosConsole.exe 404 RosConsole.exe 404 RosConsole.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe -
Processes:
resource yara_rule behavioral2/memory/316-2447-0x00007FF9B5750000-0x00007FF9B5E14000-memory.dmp upx behavioral2/memory/316-2448-0x00007FF9C5110000-0x00007FF9C5135000-memory.dmp upx behavioral2/memory/316-2449-0x00007FF9C7B40000-0x00007FF9C7B4F000-memory.dmp upx behavioral2/memory/316-2450-0x00007FF9C35F0000-0x00007FF9C360A000-memory.dmp upx behavioral2/memory/316-2451-0x00007FF9C0410000-0x00007FF9C043D000-memory.dmp upx behavioral2/memory/316-2452-0x00007FF9BE250000-0x00007FF9BE264000-memory.dmp upx behavioral2/memory/316-2453-0x00007FF9B5220000-0x00007FF9B5749000-memory.dmp upx behavioral2/memory/316-2454-0x00007FF9BDB90000-0x00007FF9BDBA9000-memory.dmp upx behavioral2/memory/316-2455-0x00007FF9C77D0000-0x00007FF9C77DD000-memory.dmp upx behavioral2/memory/316-2456-0x00007FF9B88F0000-0x00007FF9B8923000-memory.dmp upx behavioral2/memory/316-2460-0x00007FF9C5110000-0x00007FF9C5135000-memory.dmp upx behavioral2/memory/316-2459-0x00007FF9C7610000-0x00007FF9C761D000-memory.dmp upx behavioral2/memory/316-2458-0x00007FF9B5150000-0x00007FF9B521D000-memory.dmp upx behavioral2/memory/316-2457-0x00007FF9B5750000-0x00007FF9B5E14000-memory.dmp upx behavioral2/memory/316-2462-0x00007FF9B8250000-0x00007FF9B8277000-memory.dmp upx behavioral2/memory/316-2461-0x00007FF9C6EA0000-0x00007FF9C6EAB000-memory.dmp upx behavioral2/memory/316-2464-0x00007FF9B5030000-0x00007FF9B514B000-memory.dmp upx behavioral2/memory/316-2463-0x00007FF9C0410000-0x00007FF9C043D000-memory.dmp upx behavioral2/memory/316-2465-0x00007FF9BE250000-0x00007FF9BE264000-memory.dmp upx behavioral2/memory/316-2466-0x00007FF9C6AB0000-0x00007FF9C6ABF000-memory.dmp upx behavioral2/memory/316-2480-0x00007FF9B7EB0000-0x00007FF9B7EBB000-memory.dmp upx behavioral2/memory/316-2486-0x00007FF9B4FF0000-0x00007FF9B5002000-memory.dmp upx behavioral2/memory/316-2485-0x00007FF9B5010000-0x00007FF9B501D000-memory.dmp upx behavioral2/memory/316-2488-0x00007FF9B4FE0000-0x00007FF9B4FEC000-memory.dmp upx behavioral2/memory/316-2487-0x00007FF9B8250000-0x00007FF9B8277000-memory.dmp upx behavioral2/memory/316-2484-0x00007FF9B5020000-0x00007FF9B502C000-memory.dmp upx behavioral2/memory/316-2483-0x00007FF9B7EA0000-0x00007FF9B7EAC000-memory.dmp upx behavioral2/memory/316-2482-0x00007FF9B5150000-0x00007FF9B521D000-memory.dmp upx behavioral2/memory/316-2481-0x00007FF9B88F0000-0x00007FF9B8923000-memory.dmp upx behavioral2/memory/316-2478-0x00007FF9B7ED0000-0x00007FF9B7EDC000-memory.dmp upx behavioral2/memory/316-2479-0x00007FF9B7EC0000-0x00007FF9B7ECB000-memory.dmp upx behavioral2/memory/316-2477-0x00007FF9B8150000-0x00007FF9B815E000-memory.dmp upx behavioral2/memory/316-2490-0x00007FF9B4FC0000-0x00007FF9B4FD6000-memory.dmp upx behavioral2/memory/316-2492-0x00007FF9C6AB0000-0x00007FF9C6ABF000-memory.dmp upx behavioral2/memory/316-2493-0x00007FF9B4F80000-0x00007FF9B4F94000-memory.dmp upx behavioral2/memory/316-2491-0x00007FF9B4FA0000-0x00007FF9B4FB2000-memory.dmp upx behavioral2/memory/316-2489-0x00007FF9B5030000-0x00007FF9B514B000-memory.dmp upx behavioral2/memory/316-2476-0x00007FF9BDB90000-0x00007FF9BDBA9000-memory.dmp upx behavioral2/memory/316-2494-0x00007FF9B4F50000-0x00007FF9B4F72000-memory.dmp upx behavioral2/memory/316-2475-0x00007FF9C1020000-0x00007FF9C102B000-memory.dmp upx behavioral2/memory/316-2474-0x00007FF9B8220000-0x00007FF9B822C000-memory.dmp upx behavioral2/memory/316-2473-0x00007FF9B8230000-0x00007FF9B823C000-memory.dmp upx behavioral2/memory/316-2472-0x00007FF9B8240000-0x00007FF9B824B000-memory.dmp upx behavioral2/memory/316-2471-0x00007FF9B8790000-0x00007FF9B879C000-memory.dmp upx behavioral2/memory/316-2470-0x00007FF9BE240000-0x00007FF9BE24B000-memory.dmp upx behavioral2/memory/316-2469-0x00007FF9C0400000-0x00007FF9C040C000-memory.dmp upx behavioral2/memory/316-2496-0x00007FF9B4F10000-0x00007FF9B4F29000-memory.dmp upx behavioral2/memory/316-2495-0x00007FF9B4F30000-0x00007FF9B4F47000-memory.dmp upx behavioral2/memory/316-2468-0x00007FF9C35E0000-0x00007FF9C35EB000-memory.dmp upx behavioral2/memory/316-2498-0x00007FF9B4EA0000-0x00007FF9B4EB1000-memory.dmp upx behavioral2/memory/316-2497-0x00007FF9B4EC0000-0x00007FF9B4F0D000-memory.dmp upx behavioral2/memory/316-2467-0x00007FF9B5220000-0x00007FF9B5749000-memory.dmp upx behavioral2/memory/316-2499-0x00007FF9B4E70000-0x00007FF9B4E8E000-memory.dmp upx behavioral2/memory/316-2501-0x00007FF9B4DD0000-0x00007FF9B4E08000-memory.dmp upx behavioral2/memory/316-2500-0x00007FF9B4E10000-0x00007FF9B4E6D000-memory.dmp upx behavioral2/memory/316-2504-0x00007FF9B4D70000-0x00007FF9B4D9E000-memory.dmp upx behavioral2/memory/316-2508-0x00007FF9B4BC0000-0x00007FF9B4D3F000-memory.dmp upx behavioral2/memory/316-2507-0x00007FF9B4F30000-0x00007FF9B4F47000-memory.dmp upx behavioral2/memory/316-2506-0x00007FF9B4D40000-0x00007FF9B4D64000-memory.dmp upx behavioral2/memory/316-2505-0x00007FF9B4F50000-0x00007FF9B4F72000-memory.dmp upx behavioral2/memory/316-2503-0x00007FF9B4DA0000-0x00007FF9B4DC9000-memory.dmp upx behavioral2/memory/316-2502-0x00007FF9B4FA0000-0x00007FF9B4FB2000-memory.dmp upx behavioral2/memory/316-2510-0x00007FF9B4BA0000-0x00007FF9B4BB8000-memory.dmp upx behavioral2/memory/316-2516-0x00007FF9B4B70000-0x00007FF9B4B7C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RosHelp.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RosHelper = "C:\\Users\\Admin\\RosHelper\\RosHelper.exe" RosHelp.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
Processes:
flow ioc 54 discord.com 55 discord.com 56 discord.com 51 discord.com 52 discord.com 53 discord.com -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid Process 4228 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
RosHelp.exepowershell.exeRosHelper.exepowershell.exeRosHelp.exemsedge.exepid Process 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 316 RosHelp.exe 5088 powershell.exe 5088 powershell.exe 5088 powershell.exe 4332 RosHelper.exe 4332 RosHelper.exe 4332 RosHelper.exe 4332 RosHelper.exe 4332 RosHelper.exe 4332 RosHelper.exe 5048 powershell.exe 5048 powershell.exe 5048 powershell.exe 6104 RosHelp.exe 6104 RosHelp.exe 6104 RosHelp.exe 6104 RosHelp.exe 6104 RosHelp.exe 6104 RosHelp.exe 2152 msedge.exe 2152 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RosHelper.exepid Process 4332 RosHelper.exe -
Suspicious behavior: LoadsDriver 6 IoCs
Processes:
pid Process 4