Overview

overview

7

Static

static

3

d5cf01a911...f7.exe

windows7-x64

7

d5cf01a911...f7.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2024, 09:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d5cf01a911feb2dfca82c27f4f918307be09a3942846915a812fa7d5c576aaf7.exe

  • Size

    140KB

  • MD5

    14f9052e3bb370cfd3e5b91b689e0bb9

  • SHA1

    4d5390317e841c555fc60c8e4dbbcfa5b294a414

  • SHA256

    d5cf01a911feb2dfca82c27f4f918307be09a3942846915a812fa7d5c576aaf7

  • SHA512

    89843e503ef3bb508f02f0195010acb0e4711e03a52a25432433603f012b18e553df1f26629680289f5e17fcb860cc54ae4e46f4c1cdcc043440ab3c27ee8fac

  • SSDEEP

    1536:Ql/g+GBNCyBIbXpRjTPjKxIqCxMn2fls1RE0cz9:i/g/Cq+u3Cxq2fls1RE0cz9

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5cf01a911feb2dfca82c27f4f918307be09a3942846915a812fa7d5c576aaf7.exe
    "C:\Users\Admin\AppData\Local\Temp\d5cf01a911feb2dfca82c27f4f918307be09a3942846915a812fa7d5c576aaf7.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4988
    • C:\Program Files (x86)\RapidBlaster\rb32.exe
      "C:\Program Files (x86)\RapidBlaster\rb32.exe" /P "C:\Users\Admin\AppData\Local\Temp\d5cf01a911feb2dfca82c27f4f918307be09a3942846915a812fa7d5c576aaf7.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\RapidBlaster\rb32.exe
    Filesize

    140KB

    MD5

    14204ecf341c9dad9098e6f6e1f2b702

    SHA1

    4248694529392a74abf80d769f78b53aefbd4026

    SHA256

    f95d1474f8b4bb38110660346eda5b959cf3c24d5e9cb326ef4fede15ff3a9f2

    SHA512

    3b933987bb1a40a11e21c4748d54898e44d70cefa04c5a8c561ebf9dbff0aa5e5164156058610b735c10751034d9f125b3f10b9cec8ea47d15ed4c95e25f342b

    Download Submit