Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
02-10-2024 01:21
General
-
Target
rinst.exe
-
Size
22KB
-
MD5
9a00d512f9e1464ad793702cf2b1eda0
-
SHA1
39a47a90cd3dd132dbab9f5052dda38dbd7c63f6
-
SHA256
98d257f639ee9df968f77b1f66c78230d07d86e58a7ddf0d306a24af3873dc5b
-
SHA512
18604f20351db1d418f48f2eb023be07588754b428b5d6abb0a7c40d6bf174ce7dcab2ae6e06f22585e12f1bfdb6e408b17bf20e2a7ba137620002ac04b8b4ba
-
SSDEEP
384:c3PqIGR1uEtfWlXdbvoht0zsQHmr246v1hLqsHWuTqvhwp:aqZv3tfEbgIzsQHs6v1hLqQ9q
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rinst.exe"C:\Users\Admin\AppData\Local\Temp\rinst.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TibiaLogin.exe"C:\Users\Admin\AppData\Local\Temp\TibiaLogin.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\bpk.exeC:\windows\system32\bpk.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5a635bc1492e4c39ef47ed617d3dfe491
SHA1353ae5d543aee4bd2084798308a82361336b34fb
SHA256cd06f57e2e2956c634f851eb92666e9e24557fffbfcd098686e3d7fe03d8ffed
SHA512e152eaaebc4a6a48d32ed2382e048f171d35200d1654cfb241f57612b655e921b8645e700f011d3638fda4bbc7f50e90ebdc24398664a9e553540b15a006b226
-
Filesize
21KB
MD5a11068817ba83d7b8c61a5c53c5a72ab
SHA1cf4685ae095d5b1e92062c9d299cf9d250b6bab2
SHA2560ee6154256e55de7d451e729c590f5bbf65479503099c3dfeaa10deac6fe4901
SHA512a5ef2ec37eaf688c1fa926349227d25de1c5568c5630e56f8e5e3104ae6ee45275de8599d33d164cd2fc7c5b5dd853433e4228ff553d83228ae3f925446e9bae
-
Filesize
1KB
MD5e14485184a19cabb30538b7e16460844
SHA184c119193c04d622215c4cb72a5f6c7b31fe18c7
SHA2567d1af779e34f0996305a67ee263bad73971d7d4f4c298642f1f041456aec422a
SHA5126fc5f809c5ef765b066accb2caedae8b56e8536600838feffd3b0fe1ca406c718801ed37e789748cd080b69ec7518b09529285cbf035d294e42b4fa17f405818
-
Filesize
7KB
MD5df86cf4366866f625faec3fdca4866da
SHA172764f5ce86d2d64ecff5f92809b1a8f1a8b5146
SHA256e8633de442d49b4d2ce0409d3d17c73a897d2fa6412b261c1c86578f3d6e4f01
SHA51263f05b96198ef6c6c2b6fe1d966a739d7ffc503b1a08aed89d68ddd884e998b580c68d8ffcbe4ce0f1cfd31ea8a347043b91ef88726c97eea8d521018fdaf92d
-
Filesize
22KB
MD59a00d512f9e1464ad793702cf2b1eda0
SHA139a47a90cd3dd132dbab9f5052dda38dbd7c63f6
SHA25698d257f639ee9df968f77b1f66c78230d07d86e58a7ddf0d306a24af3873dc5b
SHA51218604f20351db1d418f48f2eb023be07588754b428b5d6abb0a7c40d6bf174ce7dcab2ae6e06f22585e12f1bfdb6e408b17bf20e2a7ba137620002ac04b8b4ba