General
- Target Rivlet-Setup.exe
- Size 14.5MB
- Sample260715-l83v2ac13y
- SHA256 dc4df0f6af9360fca3a56c91a50a0ecfcaac31b0fd58626afea6c0706f368e6b
Malware Config
Targets
-
- Target Rivlet-Setup.exe
- Size 14.5MB
- SHA256 dc4df0f6af9360fca3a56c91a50a0ecfcaac31b0fd58626afea6c0706f368e6b
Score7/10-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
Score3/10 -
- Target $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
Score6/10-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target Rivlet.exe
- Size 26.8MB
- SHA256 57d07c44c8f55f9eaecd867cbbb6c233aaa52864329f8c71691e28f55c3e0694
Score6/10-
Checks whether UAC is enabled
-
Network Share Discovery
Attempt to gather information on host network.
-
- Target integration/extension/content-script.js
- Size 7KB
- SHA256 013b032db46febee288b88757ee69d24b4fb07cbfc2c75033110045a69a1bea0
Score3/10 -
- Target integration/extension/options.html
- Size 1KB
- SHA256 5031a6320a7330faab6c60cec14e0d5f2ab24c2a78f6490b53f79f68908aec07
Score3/10 -
- Target integration/extension/options.js
- Size 1KB
- SHA256 f2720f4214b92585765079fd74c93bdeb7d91209220e00770a997228abeb8ba2
Score3/10 -
- Target integration/extension/service-worker.js
- Size 10KB
- SHA256 83b28a4f674f8774d32c258163b4b0cc2ac2d33c849eb619d920e8710e32a65e
Score3/10 -
- Target integration/rivlet-native-host.exe
- Size 4.1MB
- SHA256 26482123f8d0047d3f15ef5619f10dfeb888ce5774b70e890ffc83116b637cfd
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Discovery
Browser Information Discovery
1Network Share Discovery
1Query Registry
5System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1