Overview
overview
10Static
static
3Rack/023f6...10.exe
windows7-x64
10Rack/311d0...c2.exe
windows7-x64
9Rack/47f84...1f.exe
windows7-x64
9Rack/5578d...e5.exe
windows7-x64
9Rack/5606c...56.exe
windows7-x64
Rack/62354...c9.exe
windows7-x64
10Rack/666a3...e6.exe
windows7-x64
10Rack/6a08b...68.exe
windows7-x64
5Rack/73809...4e.exe
windows7-x64
10Rack/849eb...7c.exe
windows7-x64
Rack/8afc5...7e.exe
windows7-x64
9Rack/d4d53...91.exe
windows7-x64
10Rack/e4ea7...8a.exe
windows7-x64
9Rack/e5876...5c.exe
windows7-x64
9Rack/e98b1...8d.exe
windows7-x64
10Rack/fc330...dd.exe
windows7-x64
9Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-11-2024 23:49
Static task
static1
Behavioral task
behavioral1
Sample
Rack/023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral2
Sample
Rack/311d088d7c22fea0c84e1f53d3ba5dd8fb9429a2cf7476e061d061c40c20d8c2.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral3
Sample
Rack/47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Rack/5578d702c7fd246e11f71c4edb27b316ca267c6161effab324c9f6e6260bc9e5.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral5
Sample
Rack/5606ce60e5b92f774579a2e60d76a1eaccbf946df8bd5fe828ef343856b7af56.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral6
Sample
Rack/6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
Rack/666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Rack/6a08b51e02a7b510972907c326041222ff4632ba53b89573fca7e80b59c4e168.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral9
Sample
Rack/73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Rack/849ebe96bbc8cb10dc7f980e272aea06dbedc66d7228ff1333542a7ff6aa017c.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
Rack/8afc51fb904b25124bd5cb41985e917333071d1af1c6ab83cc7ae408e7cb0e7e.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral12
Sample
Rack/d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
Rack/e4ea72a1de2c5e1388cb35eee6beffdae4e06f9fe08f9aca04ad6350e32e338a.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
Rack/e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
Rack/e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
Rack/fc330047cbdd7edc5776a5ef560e9ca73f3986ccd17f0e775a57b563dd8a2cdd.exe
Resource
win7-20241010-en
windows7-x64
General
-
Target
Rack/6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe
-
Size
96KB
-
MD5
833a318c7e39fff973bc37a66715b452
-
SHA1
e5d5539eb70c8a23cb115dd042fb3693a775cbba
-
SHA256
6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9
-
SHA512
821c8bfd341bc2f5d83f66e9e5844b6ebd5ab0dd633bc0a1fddfba079831485f4f7507e8abeabb9265199a9a959b1dd0299a5bb1bee09780386aade6e6efde94
-
SSDEEP
1536:akH/EAQ3tLLXfHY1P6I/v5zKdNm/UhVqLas/OFgnND:aBAQ3hfCP6Y52g/UhVqOeOGnND
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1243194978 = "C:\\ProgramData\\msxobbm.exe" msiexec.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 2516 msiexec.exe -
Blocklisted process makes network request 64 IoCs
flow pid Process 3 2516 msiexec.exe 4 2516 msiexec.exe 6 2516 msiexec.exe 7 2516 msiexec.exe 10 2516 msiexec.exe 12 2516 msiexec.exe 14 2516 msiexec.exe 16 2516 msiexec.exe 18 2516 msiexec.exe 20 2516 msiexec.exe 22 2516 msiexec.exe 24 2516 msiexec.exe 26 2516 msiexec.exe 28 2516 msiexec.exe 30 2516 msiexec.exe 32 2516 msiexec.exe 34 2516 msiexec.exe 36 2516 msiexec.exe 38 2516 msiexec.exe 40 2516 msiexec.exe 42 2516 msiexec.exe 44 2516 msiexec.exe 46 2516 msiexec.exe 48 2516 msiexec.exe 50 2516 msiexec.exe 52 2516 msiexec.exe 54 2516 msiexec.exe 56 2516 msiexec.exe 58 2516 msiexec.exe 60 2516 msiexec.exe 61 2516 msiexec.exe 62 2516 msiexec.exe 63 2516 msiexec.exe 64 2516 msiexec.exe 65 2516 msiexec.exe 66 2516 msiexec.exe 67 2516 msiexec.exe 68 2516 msiexec.exe 69 2516 msiexec.exe 70 2516 msiexec.exe 71 2516 msiexec.exe 72 2516 msiexec.exe 73 2516 msiexec.exe 74 2516 msiexec.exe 75 2516 msiexec.exe 76 2516 msiexec.exe 77 2516 msiexec.exe 78 2516 msiexec.exe 79 2516 msiexec.exe 80 2516 msiexec.exe 81 2516 msiexec.exe 82 2516 msiexec.exe 83 2516 msiexec.exe 84 2516 msiexec.exe 85 2516 msiexec.exe 86 2516 msiexec.exe 87 2516 msiexec.exe 88 2516 msiexec.exe 89 2516 msiexec.exe 90 2516 msiexec.exe 91 2516 msiexec.exe 92 2516 msiexec.exe 93 2516 msiexec.exe 94 2516 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1872 set thread context of 2860 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 2516 msiexec.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2516 msiexec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1872 wrote to memory of 2860 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 28 PID 1872 wrote to memory of 2860 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 28 PID 1872 wrote to memory of 2860 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 28 PID 1872 wrote to memory of 2860 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 28 PID 1872 wrote to memory of 2860 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 28 PID 1872 wrote to memory of 2860 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 28 PID 1872 wrote to memory of 2860 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 28 PID 1872 wrote to memory of 2860 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 28 PID 1872 wrote to memory of 2860 1872 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 28 PID 2860 wrote to memory of 2184 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 29 PID 2860 wrote to memory of 2184 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 29 PID 2860 wrote to memory of 2184 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 29 PID 2860 wrote to memory of 2184 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 29 PID 2860 wrote to memory of 2184 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 29 PID 2860 wrote to memory of 2184 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 29 PID 2860 wrote to memory of 2184 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 29 PID 2860 wrote to memory of 2516 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 30 PID 2860 wrote to memory of 2516 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 30 PID 2860 wrote to memory of 2516 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 30 PID 2860 wrote to memory of 2516 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 30 PID 2860 wrote to memory of 2516 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 30 PID 2860 wrote to memory of 2516 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 30 PID 2860 wrote to memory of 2516 2860 6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rack\6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe"C:\Users\Admin\AppData\Local\Temp\Rack\6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\Rack\6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe"C:\Users\Admin\AppData\Local\Temp\Rack\6235491cac4d58eb04c20f1649de6b3381972cdd33158b797fa6f6845afcd2c9.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2184
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Deletes itself
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1