0aabc01b865bd5d6404583b1a35f4236b740b7c3502c919bc165f00a7e7acde5

Sharing

Copy URL Twitter E-mail

General

Target
Risk of Rain Returns.rar
Size 554.0MB
Sample260703-rskx6sf14p
SHA256 0aabc01b865bd5d6404583b1a35f4236b740b7c3502c919bc165f00a7e7acde5
MD5 cfd1e5c7ad8cbefc62224d6f995b7857
SHA1 9cf3b7ea6cbe731581196c1e2998434754b82c7b
SHA512 eebfa2f8e15197229ecf8cdda26f45265febfb2a037760c10ec07dcb57ca4ae98b15bfc11aa258da2262d30f6e8b69cf7057be5a088542c49dac0e27d5d49fcc
SSDEEP 12582912:iDe0hDe0h1SRR7eJfutE+KDYeWDoMZvoF1shdBQpum2qx3OxpU:iDe0hDe0WRpumm+8YeWsYvC1x/j+xm
TLSH
T1D1590172BA429904DC268B3C8E22CB61D7613C55EF16C6A77091F60D2DFF3C0997D6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Common Redist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Common Redist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  Common Redist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- TLSH
  T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  Common Redist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- TLSH
  T134E633326554402AEBF20573AAA4F5342E7DE62D230449AEE3DCEC0D2FB919357F7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  Common Redist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- TLSH
  T19A4633229343E243EC97FEB8E16E484FDD65C2B31736D6677326848D9D3DB1848A0399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral10 behavioral9
- Target
  Common Redist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral11 behavioral12
- Target
  Common Redist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  Risk of Rain Returns/OnlineFix.url
- Size 46B
- SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
- MD5 59bf167dc52a52f6e45f418f8c73ffa1
- SHA1 fa006950a6a971e89d4a1c23070d458a30463999
- SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
- MD5 SHA1 SHA512
Score

1^/10
behavioral15 behavioral16
- Target
  Risk of Rain Returns/OnlineFix64.dll
- Size 10.3MB
- SHA256 a188ff24aec863479408cee54b337a2fce25b9372ba5573595f7a54b784c65f8
- MD5 0cccdd04b47dfcd6d20b4d1e21738cca
- SHA1 5f53ebc37fd70de1be2c52494dfde51674dff7f0
- SHA512 9b7ecfcb22e37a6d6ecd6ff650806549352cbdc26c4c2ed1573b08c701cddbd46a9dc774cef79c4eb740208830ee6edbfeb9bd9009bf0fb155ed360bec7aea3f
- SSDEEP 196608:g3giiPVCn+q0Xa8YNUAu9weVbiGEL92ZjSnzo2+pIyis:gQ9VC9oeUAYgpzmph
- TLSH
  T1F8B622EE99F553B5D0925600798A43967180664880FD0C2A3DDB2D067FD8CBF618EFBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Risk of Rain Returns/Risk of Rain Returns.exe
- Size 32.4MB
- SHA256 f2f858fe13e11fa01833d35be82bc036a81b3bf02ea8715bce009397946b6b1e
- MD5 59070de32c96d771f0eb8f1cfa3248b4
- SHA1 c910a6658c10df31a56e095f24fcda386a65752f
- SHA512 762cfbdf0735e917323f61382f15b3cd977dcb0e70ef0f032fb9866407d6fd4e137982bfc7e0fdf186192206c234e13fa3a7d12a3b7fb632cacaa361c263374a
- SSDEEP 393216:MK4zQTe64cBjs4nhO5YeT1ElW7W5tr5bo3Q2uXJ5e6Fus3:0Yjs48qXneAuo
- TLSH
  T17B774B24395ADA9DD076C47CCA22DA53E6203CE8C7394AFBC5B036170FFE6E09535A16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral19 behavioral20
- Target
  Risk of Rain Returns/RoRRWinExt.dll
- Size 13KB
- SHA256 be98d5b42a9cdd0c777064a34a37f38bae558d340e75a2fd674406725d05c3c9
- MD5 8efa1d13c6316970dbac47eb9b86f465
- SHA1 35b5d14fd91e660757b4c56c9e9aeb1c4557314e
- SHA512 ae6c2646cafd28f320c42dc355fca0ded2d3bca140f39c6ab9f97028316f0028e7b768a2c9594bed8540f5aae00587bf5245a2c5ba813299ff628249fb7ee006
- SSDEEP 192:pHZpQCQGE52qepHaY/pvkluTklyrdDFOrrhW:p/XQGE5RepHaYhVklyPOR
- TLSH
  T10A521A46BB804DFBD0554235C8732B16E237F3245BA1D38F5B62435E1E727913A3A629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Risk of Rain Returns/Steamworks_x64.dll
- Size 432KB
- SHA256 2601b6af66ee88c0e6ac8185a6245c5596a61d567b70280db3403f846774da75
- MD5 49a0d1bae2d0a085f57fad71c054b2fd
- SHA1 21773d984e09c89b243f0e3f988188bfc752dd68
- SHA512 c64230b46fd553ebb5464b30b58b01d2b4aef3b7c188dbd8838ec17bc672954563f5072cc49f186919cf38decaba9a95f41430831e04ea195bbd0b7aab547970
- SSDEEP 6144:LzfU8ob+oLJBcJWcnW9GQ2Hrks8pv8LpwnohQ0u+yG/D9bY:Lzc8ucWOJQYYsMuioa0u+v
- TLSH
  T132946B4AF7A510A6D167D178CD639907E673384A03A2C7DF13A4926E2F37BD0293E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Risk of Rain Returns/display_mouse_lock_x64.dll
- Size 90KB
- SHA256 a2a7b606744587f6d8afe50e68292dc19b1798bca45d97296a4a0a3c753d424b
- MD5 ba8d20b8df99061db0d13bcad7b33ec5
- SHA1 84508888d08542dd91c213437b0f679ac606dafc
- SHA512 cec3270f8c791fb5b5bd64b283360cb23d3168305d8ee953412059f18337b7e2fb659d196d90ec9ec4482a0a93325c20ee8447f6eab03f2a7b44c2dcc97d8a44
- SSDEEP 1536:wNhPoMvMPxmknpoSImaBkj4xsSyJs7UsWe1Ed09dlTMlNBntEVJ:wNhPoMvQxy9maWj4xsXi7bcMZMlnntK
- TLSH
  T12D93385B62E500BBE4328638C4A30E19D776F8161661DF6F0364065E2F773D28E3AB72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Risk of Rain Returns/steam_api64.dll
- Size 291KB
- SHA256 395c5a430c080b3eb99357da70471c3a87049b3b6170bda65b4f64a7f66b22f5
- MD5 1c48d80ac6f880a0e1300ed04d44efc2
- SHA1 f6fe3a4513da7bd57e7e546c6e6686ec72434561
- SHA512 5e83eaa660ed826a4abf1ace8460e375800b4eba2f692672b5cee51a2ffd2d88afc3eab1cb12d3404a439ce1c3b7d8c2f3857cd2773f28b7b705e4cd307baa0e
- SSDEEP 3072:504VEQ2u/niy9UVLCe9ZqdrP+VXvv+sJYB2RHKBi65lhTbCc+hnvvEyP7yq+ueic:QZu/i874ZcrMv2cRh7yqO2CP2HxYq8/B
- TLSH
  T12D54487AA2710CF4E076C13A88565E0FF671744B63219EFF226053369E576C21E3BBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Risk of Rain Returns/steam_api64.of
- Size 291KB
- SHA256 1db3fd414039d3e5815a5721925dd2e0a3a9f2549603c6cab7c49b84966a1af3
- MD5 6b4ab6e60364c55f18a56a39021b74a6
- SHA1 39cac2889d8ca497ee0d8434fc9f6966f18fa336
- SHA512 c08de8c6e331d13dfe868ab340e41552fc49123a9f782a5a63b95795d5d979e68b5a6ab171153978679c0791dc3e3809c883471a05864041ce60b240ccdd4c21
- SSDEEP 3072:504VEQ2u/niy9UVLCe9ZqdrP+VXvv+sJYB2RHKBi65lhTbCc+hnvvEyP7yq+uei1:QZu/i874ZcrMv2cRh7yqO2CPLHxYq8/B
- TLSH
  T1AB54487AA2710CF4E076C13A88565E0FF671744B63219EFF226053369E576C21E3BBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Checks installed software on the system

Enumerates connected drives

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

Drops file in System32 directory

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30