Analysis
-
max time kernel
190s -
max time network
96s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
02-11-2024 17:12
General
-
Target
RPGXP_E.exe
-
Size
27.2MB
-
MD5
4db4691a4f71af97b109b11ee2c70ec9
-
SHA1
ba5eaa22936505df35a10319dbce60ed6e873383
-
SHA256
7f0005d39580ba537d4f9581b47c28adf132a6586d62881a62cd56fa1b24ab27
-
SHA512
2688575f993dd7c2b0bff1634465149103412032bc882d09ccd492033ec94b27c84e4a1655118264728fea358969504ff748a8e6fe73dd313789f2a2d142f15a
-
SSDEEP
786432:F6HKbIBBYy9IMhfpNIubCq9iS2wvX1RA6rxiShm0RML1P:+iI3/9IM6uejAX1RUShT
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
-
Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
-
Drops file in System32 directory 6 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 12 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RPGXP_E.exe"C:\Users\Admin\AppData\Local\Temp\RPGXP_E.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PQLGF.tmp\RPGXP_E.tmp"C:\Users\Admin\AppData\Local\Temp\is-PQLGF.tmp\RPGXP_E.tmp" /SL5="$502E4,28152842,118784,C:\Users\Admin\AppData\Local\Temp\RPGXP_E.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KHGAK.tmp\xp_rtp104e.exe"C:\Users\Admin\AppData\Local\Temp\is-KHGAK.tmp\xp_rtp104e.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OK5PJ.tmp\xp_rtp104e.tmp"C:\Users\Admin\AppData\Local\Temp\is-OK5PJ.tmp\xp_rtp104e.tmp" /SL5="$C0070,22729139,53248,C:\Users\Admin\AppData\Local\Temp\is-KHGAK.tmp\xp_rtp104e.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\d9a7ca93c64d403c8d269b63ee227d31 /t 3812 /p 41161⤵
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\2a59cb4d791d46ea9416e1a3ba221024 /t 1172 /p 7841⤵
-
C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"C:\Program Files (x86)\Enterbrain\RPGXP\RPGXP.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD56f6ccdccf5bd0946a2b55a014329bdac
SHA148bbe60410e70a991d7ffea90e3e1279ee456c78
SHA256ecb1f0805161e359adedb28b2fa7f8c4d8586d6d5d69a37dd05757618f9e551f
SHA512092d982773dd62e4d6f3a60c83d7e0f7c8ab07afaca3ecfdf960014452e78d4f6437008e8b110993b8e6a798110a736b9be0189f932c348d5b74b23c6cd7b7e1
-
Filesize
8KB
MD5592adc03e205672e8a4f790f685c658f
SHA170e40b322ad187e9860d3619edac25d30624d17f
SHA256aabb33a465c18dcba522190d57100cf3e07107651084275645785625f3f4ff7e
SHA512c21e1eaee0ced3e57e518bc72c87b9cfa615d84d44081e868dcaa4f5fcb95273028a1ebb7854d7feab098973e066a607d586b537b5ad2ac2a04f88e7048ec03e
-
Filesize
644KB
MD52ecb353c8974f1020d1425dfb8d4f591
SHA164b4196b78b4cdba32d8a5f14391861973dbe676
SHA256614ffaa33a9bf1453dbac9033c941aea534cf12fe89f568344d94217497ac674
SHA5120b079efff3c97d059eeed87df6433fc3929f18542d700bbee5c4f32ba5e2e216c68cc8403c2d9224cae2cc92550c7e668b1152586db6b8579f4ddaa8fbbbb9df
-
Filesize
9KB
MD5ffffdaaf9f1c7c47a4761df64f4ee56b
SHA16a3fd89cf56f9341bd872fad778af56f39a418f2
SHA256c4c87ffce5df52d6acf28a94aa5414fd7305d44825394fe4cb809ca20e6bcf54
SHA512b19ddd75a6a6d1dc44e70c30a01c7474bed5eab02d366786ef063be756a4993896038f0a368a00b5e383d639005ecf1f2e0f1d4223133b0b40340f8d777d0c2d
-
Filesize
10KB
MD5ff708a85d46bc03f24dbf1e5119aadab
SHA139882cb9b2c82f8d1fbcefe1e0b0b41acbff5205
SHA256dba7d3497b93f4752169ea3b19ee9a2727aed3dc0f58f722908d77e315851497
SHA512f1869c1f5f46d8d906cbe142aa4f1b08e21ce388265e80622dbc099ecdc1987709a20546f8b33018cfc4806d8c4eda3e1b4ee1f362a77802bc0eb592e30c3fd4
-
Filesize
4KB
MD57f1b95225ec76ae446a9f149bd6124f5
SHA10c0e5c159facd1a075e1b50b013123fab5ad6706
SHA256a90e6a055e9b38788ca782a0641a247b58e857bdd91364ac6248d67497b1c817
SHA512d914061975c0f1debfabe59a0bca8db00a5ac4af96d3f530cbf0cdd02e6e848bc0cff17cddd9436b7d0159671b3e791770b665fafabba89a642304b2b1cd5965
-
Filesize
136B
MD5ddde943e60b711399007f7894722a77a
SHA10ca8e93c5f8862c39038777497d2c6fe506826a3
SHA25629dcba55ab1c35f14b4db7b1b956c54abf452f05add27cfae9222568008eed1b
SHA51213f9eef3b9007ea04667311288d475bee432b37ef44616565392469df1db46239607a930659686182ee89dde63af0d1428939e315f3acb52d4087cf2e02ba3bc
-
Filesize
3KB
MD5a8d38bf2fdf4c910a5dacbfcb4e438ad
SHA10d908e6870f88982bcde6f16ecedf14f521bc2a1
SHA256ed8f601c12da4519e2a5396259b926d8ab7222365b62dbada0d75fbc237dd6c3
SHA5120b157454b032c619d31dd7afd643390e595294abf7701a98294d566e90097134d58d42a6dc6c6a7670450a2e854d59888b987b1e961342630a3f07af774af2f0
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
21.9MB
MD5611881d2a5b8825df189616e7a2760f3
SHA12a907a5371d27dbf80cd9efc399fff76109a3968
SHA256b3bd20ad7f413b40ac233aafd2e061de1dc429c2eadb59d0b3157ba3c47f16b2
SHA512d79d8f57f8219574723239c0091068db64d2304e6b7495187247397491371e8761e711d027cab36bd08cbf86a1bf805dfbfeaff910f6b49458ff9c0c5872af23
-
Filesize
669KB
MD552950ac9e2b481453082f096120e355a
SHA1159c09db1abcee9114b4f792ffba255c78a6e6c3
SHA25625fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd
SHA5125b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba
-
Filesize
1.1MB
MD563b15124be653dbe589c7981da9d397c
SHA1af8874bdf2ad726f5420e8132c10becc2bbcd93c
SHA25661674b90891ca099d5fee62bf063a948a80863530ab6a31e7f9e06f0e5bc7599
SHA512339b284b5dd7386dcfa86c8fdcf239a0e97cc168229ea9a66fc0c6b26771401fa7f27c2c6a435a836a43ea9c7e634a3e47ec77e0d27985794bbb4416dfc97ac8
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
68KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
