Overview

overview

10

Static

static

1

RNSM00471.7z

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RNSM00471.7z

  • Size

    77.9MB

  • Sample

    240927-mdl5gaxfjj

  • MD5

    316fa4481b18d738d63477376675a281

  • SHA1

    1c0c3b8661e6033740b6d27021afabfd71f1fb13

  • SHA256

    7c4210c18bbe5b1af9000ae38953c5c52bfe5de023b640492d3f296d0f4caec4

  • SHA512

    260427131dc32da771c403848f51d64470897a39de37bbbae2964099b4b2ef2d4a099af66c3e4c7ef1f7eaaadddc970e71f0100b348502659bdeee50e2dfb1f0

  • SSDEEP

    1572864:yvUoQ9DhK3exOjITTZtcP2EeyBsFFYttMZfL1py:yvUoQphtcuMB6itOA

Score
10/10
atomsilourelasvanillaratdiscoveryexecutionpersistencepyinstallerransomwarerattrojanupxvmprotect

Malware Config

Targets

    • Target

      RNSM00471.7z

    • Size

      77.9MB

    • MD5

      316fa4481b18d738d63477376675a281

    • SHA1

      1c0c3b8661e6033740b6d27021afabfd71f1fb13

    • SHA256

      7c4210c18bbe5b1af9000ae38953c5c52bfe5de023b640492d3f296d0f4caec4

    • SHA512

      260427131dc32da771c403848f51d64470897a39de37bbbae2964099b4b2ef2d4a099af66c3e4c7ef1f7eaaadddc970e71f0100b348502659bdeee50e2dfb1f0

    • SSDEEP

      1572864:yvUoQ9DhK3exOjITTZtcP2EeyBsFFYttMZfL1py:yvUoQphtcuMB6itOA

    Score
    10/10
    atomsilourelasvanillaratdiscoveryexecutionpersistencepyinstallerransomwarerattrojanupxvmprotect

    • AtomSilo

      Ransomware family first seen in September 2021.

      ransomwareatomsilo

    • AtomSilo Ransomware

    • Modifies WinLogon for persistence

      persistence

    • Urelas

      Urelas is a trojan targeting card games.

      trojanurelas

    • VanillaRat

      VanillaRat is an advanced remote administration tool coded in C#.

      ratvanillarat

    • Vanilla Rat payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks