Overview

overview

7

Static

static

7

Redist/DXWebSetup.exe

windows10-2004-x64

3

Redist/DXWebSetup.exe

windows11-ltsc_2024-x64

3

Redist/Dir...UP.dll

windows10-2004-x64

4

Redist/Dir...UP.dll

windows11-ltsc_2024-x64

4

Redist/Dir...32.dll

windows10-2004-x64

4

Redist/Dir...32.dll

windows11-ltsc_2024-x64

4

Redist/Phy...re.exe

windows10-2004-x64

7

Redist/Phy...re.exe

windows11-ltsc_2024-x64

7

Redist/vc_...64.exe

windows10-2004-x64

1

Redist/vc_...64.exe

windows11-ltsc_2024-x64

1

Redist/vcr...86.exe

windows10-2004-x64

7

Redist/vcr...86.exe

windows11-ltsc_2024-x64

7

RimWorld/D...ic.wsf

windows10-2004-x64

5

RimWorld/D...ic.wsf

windows11-ltsc_2024-x64

5

RimWorld/D...sc.wsf

windows10-2004-x64

5

RimWorld/D...sc.wsf

windows11-ltsc_2024-x64

5

RimWorld/D...on.wsf

windows10-2004-x64

5

RimWorld/D...on.wsf

windows11-ltsc_2024-x64

5

RimWorld/D...sc.wsf

windows10-2004-x64

5

RimWorld/D...sc.wsf

windows11-ltsc_2024-x64

5

RimWorld/D...sc.wsf

windows10-2004-x64

5

RimWorld/D...sc.wsf

windows11-ltsc_2024-x64

5

RimWorld/D...rs.wsf

windows10-2004-x64

5

RimWorld/D...rs.wsf

windows11-ltsc_2024-x64

5

RimWorld/D...ip.wsf

windows10-2004-x64

5

RimWorld/D...ip.wsf

windows11-ltsc_2024-x64

5

RimWorld/D...sc.wsf

windows10-2004-x64

5

RimWorld/D...sc.wsf

windows11-ltsc_2024-x64

5

RimWorld/D...re.wsf

windows10-2004-x64

5

RimWorld/D...re.wsf

windows11-ltsc_2024-x64

5

RimWorld/D...rs.wsf

windows10-2004-x64

5

RimWorld/D...rs.wsf

windows11-ltsc_2024-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    Rimworld-AnkerGames.zip
  • Size 834.0MB
  • Sample260913-ecslvscj3y
  • SHA256 218cfbab6fd9eb7761e03c7a9bce0e017d9e5a829269a4d46308bf2cade5f37f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Targets

    • Target
      Redist/DXWebSetup.exe
    • Size 65KB
    • SHA256 7e963c1bec5df9b42773877bc24291a04095bbfe5f7128b1286f061c4423a071
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral1behavioral2
    • Target
      Redist/DirectX/DSETUP.dll
    • Size 91KB
    • SHA256 9d47b4fa2dcce6a02a51324cfb97f5e153086c2eb8832b211e175cbe5fb850b3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral3behavioral4
    • Target
      Redist/DirectX/dsetup32.dll
    • Size 1.6MB
    • SHA256 a5c6df12f9fe2edab2a22fe7abf3cb17eac110a6fd469f2570ba04afc88ad767
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discoveryransomware
    behavioral5behavioral6
    • Target
      Redist/PhysX_9.08.14_9.09.0814_SystemSoftware.exe
    • Size 39.3MB
    • SHA256 4a1364e2b1c6885bac14f5147cd00f2ca6925389d3d8ce012e4e552f2ed68469
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoveryransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral7behavioral8
    • Target
      Redist/vc_redist.x64.exe
    • Size 64KB
    • SHA256 e71cedb54fc958f48cc8af76eed9ec996d9e9c43f425731c7cd3a6d17fb2ed81
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      Redist/vcredist_x86.exe
    • Size 2.6MB
    • SHA256 3453e87aa523e54f07337abe75c047b1e827c02b105a92028dc55dede9f97ffb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistenceprivilege_escalationransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral11behavioral12
    • Target
      RimWorld/Data/Anomaly/Defs/HediffDefs/Hediffs_BodyParts_Prosthetic.xml
    • Size 30KB
    • SHA256 3057ae755d88a1992a5f09c106bc7a6a82e54fde25a057c83a5aca1016fe3b7e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral13behavioral14
    • Target
      RimWorld/Data/Anomaly/Defs/HediffDefs/Hediffs_Global_Misc.xml
    • Size 46KB
    • SHA256 2a10915d94d6815b736f9fb16db95171c442bfd2874d85a36c511d3ffdbda6fc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral15behavioral16
    • Target
      RimWorld/Data/Anomaly/Defs/RecipeDefs/Recipes_Production.xml
    • Size 1KB
    • SHA256 8e7ee60f8df7082bedf061069f3c04dd88b923034e2dc067bf0382e3e154d492
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral17behavioral18
    • Target
      RimWorld/Data/Anomaly/Defs/RecipeDefs/Recipes_Surgery_Misc.xml
    • Size 4KB
    • SHA256 a35ae3c3b969fcfab67ffdbb7b402327091f73672cad60d05024326d5bfaf91a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral19behavioral20
    • Target
      RimWorld/Data/Anomaly/Defs/ThingDefs_Buildings/Buildings_Misc.xml
    • Size 53KB
    • SHA256 d291b1628db420b3ca00e9b5e598ff03e3e5c9c0da3df50c02e71e2cde1f99d3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral21behavioral22
    • Target
      RimWorld/Data/Odyssey/Defs/Joy/JoyGivers.xml
    • Size 278B
    • SHA256 463dcafdf35a1731a4592df60e14a58b08608bd0ede6ff2536e0cc254764937f
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral23behavioral24
    • Target
      RimWorld/Data/Odyssey/Defs/ThingDefs_Buildings/Buildings_Gravship.xml
    • Size 33KB
    • SHA256 63b898a50f7b22809906c8aa6897987bd4bdac21962ed9c9321d28b1d804ef9b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral25behavioral26
    • Target
      RimWorld/Data/Odyssey/Defs/ThingDefs_Buildings/Buildings_Misc.xml
    • Size 56KB
    • SHA256 53ce38ae5523431268933249309582be9e23d36b23d191ebecb4cd9c92fdff57
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral27behavioral28
    • Target
      RimWorld/Data/Royalty/Defs/HediffDefs/Hediffs_BodyParts_Prosthetic_Empire.xml
    • Size 25KB
    • SHA256 608c0bf8808b629ecadbe75e2b329f053b8ac4b144f4e87206a06a84d10e6150
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral29behavioral30
    • Target
      RimWorld/Data/Royalty/Defs/Joy/JoyGivers.xml
    • Size 612B
    • SHA256 bdc54c05b9e01b191070aaf6693a5d8fba34ca9b063d88e52c07567225993bb1
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Visual Basic

1
T1059.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Installer Packages

1
T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Installer Packages

1
T1546.016

Defense Evasion

Modify Registry

1
T1112

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

3
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
7/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
4/10

behavioral4

discovery
Score
4/10

behavioral5

discoveryransomware
Score
4/10

behavioral6

discovery
Score
4/10

behavioral7

discoveryransomware
Score
7/10

behavioral8

discoveryransomware
Score
7/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

discoverypersistenceprivilege_escalationransomware
Score
7/10

behavioral12

discoverypersistenceprivilege_escalationransomware
Score
7/10

behavioral13

execution
Score
5/10

behavioral14

execution
Score
5/10

behavioral15

execution
Score
5/10

behavioral16

execution
Score
5/10

behavioral17

execution
Score
5/10

behavioral18

execution
Score
5/10

behavioral19

execution
Score
5/10

behavioral20

execution
Score
5/10

behavioral21

execution
Score
5/10

behavioral22

execution
Score
5/10

behavioral23

execution
Score
5/10

behavioral24

execution
Score
5/10

behavioral25

execution
Score
5/10

behavioral26

execution
Score
5/10

behavioral27

execution
Score
5/10

behavioral28

execution
Score
5/10

behavioral29

execution
Score
5/10

behavioral30

execution
Score
5/10

behavioral31

execution
Score
5/10

behavioral32

execution
Score
5/10