e6e927973d20d6a1734c4b2588d0e8393c7372cf632f7938cfc5baabfbe0f671

General

Target

RisxnBoost.exe
Size

13KB
MD5

bc0042fdab4b082ce767ed9a9f08b492
SHA1

837ee6acbc279292da3f8bf5ba2b0e60e897b2ed
SHA256

e6e927973d20d6a1734c4b2588d0e8393c7372cf632f7938cfc5baabfbe0f671
SHA512

aba843c53255d5268eaa40d7c4cf3bbd7b298981b1f11cfaccbb759896ee8aebd33b8b8d9ce99fa075374684db8f4e0987ddd5ae0c51d4d84e26466777fa83e7
SSDEEP

384:9DMu9YLDZWi7W/dCHaNJawcudoD7UqkkO+Ozu:pMu8WkL6nbcuyD7U

Score

10^/10

discovery evasion execution trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe
Executes dropped EXE 1 IoCs

Processes:

b2e.exe

pid process

2324 b2e.exe
Loads dropped DLL 2 IoCs

Processes:

RisxnBoost.exe

pid process

1620 RisxnBoost.exe
1620 RisxnBoost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

pid	process
2324	b2e.exe

pid	process
1620	RisxnBoost.exe
1620	RisxnBoost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1620-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1620-12-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2832 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2832	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

reg.exepowershell.exechcp.comRisxnBoost.exeb2e.execmd.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RisxnBoost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2832 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2832 powershell.exe

pid	process
2832	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2832	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

RisxnBoost.exeb2e.execmd.exe

description	pid	process	target process
PID 1620 wrote to memory of 2324	1620	RisxnBoost.exe	b2e.exe
PID 1620 wrote to memory of 2324	1620	RisxnBoost.exe	b2e.exe
PID 1620 wrote to memory of 2324	1620	RisxnBoost.exe	b2e.exe
PID 1620 wrote to memory of 2324	1620	RisxnBoost.exe	b2e.exe
PID 2324 wrote to memory of 796	2324	b2e.exe	cmd.exe
PID 2324 wrote to memory of 796	2324	b2e.exe	cmd.exe
PID 2324 wrote to memory of 796	2324	b2e.exe	cmd.exe
PID 2324 wrote to memory of 796	2324	b2e.exe	cmd.exe
PID 796 wrote to memory of 484	796	cmd.exe	reg.exe
PID 796 wrote to memory of 484	796	cmd.exe	reg.exe
PID 796 wrote to memory of 484	796	cmd.exe	reg.exe
PID 796 wrote to memory of 484	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2236	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2236	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2236	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2236	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2744	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2744	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2744	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2744	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2820	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2820	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2820	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2820	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2804	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2804	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2804	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2804	796	cmd.exe	reg.exe
PID 796 wrote to memory of 2832	796	cmd.exe	powershell.exe
PID 796 wrote to memory of 2832	796	cmd.exe	powershell.exe
PID 796 wrote to memory of 2832	796	cmd.exe	powershell.exe
PID 796 wrote to memory of 2832	796	cmd.exe	powershell.exe
PID 796 wrote to memory of 2616	796	cmd.exe	chcp.com
PID 796 wrote to memory of 2616	796	cmd.exe	chcp.com
PID 796 wrote to memory of 2616	796	cmd.exe	chcp.com
PID 796 wrote to memory of 2616	796	cmd.exe	chcp.com

C:\Users\Admin\AppData\Local\Temp\RisxnBoost.exe
"C:\Users\Admin\AppData\Local\Temp\RisxnBoost.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\C207.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\C207.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\C207.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\RisxnBoost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\C2A3.tmp\batchfile.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      PID:484
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2236
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2744
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2820
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2804
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2832
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C2A3.tmp\batchfile.bat

Filesize
7KB

MD5
5a95e2ef57f88ba9d2615eb9bdda1bae

SHA1
3172110f628a747a5b1468d79c3337d10d6ee005

SHA256
905aff32847ecf10d10b85ec7affdfb52109815ee2e93f5681440bf1cd210aef

SHA512
ddc5484de715449f6802054dc4733d4884aa368e704f66fac1530b77e05b12fd92c4afeb93dbea166f4deaae1335aa3d24bbf8710ba57d28a737fe4a82e12f4f

Download Submit
\Users\Admin\AppData\Local\Temp\C207.tmp\b2e.exe

Filesize
16KB

MD5
dd91a1046be6aa01ca5234044ec98b61

SHA1
d81a3442289b83214f5c2033d991a657a8f31704

SHA256
89deecad9df7521c3ff747cb56f10aaceb41f32ecda72fb06624280e45d21e7d

SHA512
bdc79f7906f739c75add8d4dc6ba90f7c38ede0400db3b2b5b6f47fb217cd13ec0ba8dea77053112ea8de768ad7dc137eb54a893b6024d4dc181dad4d7c28fcf

Download Submit
memory/1620-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1620-5-0x0000000000250000-0x0000000000255000-memory.dmp

Filesize
20KB

Download
memory/1620-12-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2324-13-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2324-32-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads