Analysis
-
max time kernel
26s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-10-2024 00:11
Behavioral task
behavioral1
Sample
reapware.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
reapware.exe
-
Size
7.4MB
-
MD5
3f88af2ff6c929380294ea6b406de9aa
-
SHA1
f95a0fa62b803094ce969b37364e3aa1d8079c52
-
SHA256
7a8ba863b86526b5aa7eb5efea18415162aef77a8cb1f2c328bf42edd3853b39
-
SHA512
68ce9bc911bc0f0d3fd6821bbd6b20afcfc71e0469d10e668c754900be16ed7b52af50813663d0b1c9a82f83848cc26e34afa82b3f6c3e2ac2c38e57657face9
-
SSDEEP
98304:vvSi8x9XQs0UurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EJKhOC11L:vaP9V0UurErvI9pWjgfPvzm6gsFEg4At
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2804 reapware.exe -
resource yara_rule behavioral1/files/0x000500000001925d-21.dat upx -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2304 taskmgr.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe -
Suspicious use of SendNotifyMessage 36 IoCs
pid Process 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe 2304 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2804 2308 reapware.exe 31 PID 2308 wrote to memory of 2804 2308 reapware.exe 31 PID 2308 wrote to memory of 2804 2308 reapware.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\reapware.exe"C:\Users\Admin\AppData\Local\Temp\reapware.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\reapware.exe"C:\Users\Admin\AppData\Local\Temp\reapware.exe"2⤵
- Loads dropped DLL
PID:2804
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2304
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5ccdbd8027f165575a66245f8e9d140de
SHA1d91786422ce1f1ad35c528d1c4cd28b753a81550
SHA256503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971
SHA512870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311