2557c79fe1a0bd5355a2602ba0d570a944b6d5557e272385a1f4ef3448d59fd0

General

Target
RecFlareSetup.exe
Size 2.5MB
Sample261006-pyfvasbv2l
SHA256 2557c79fe1a0bd5355a2602ba0d570a944b6d5557e272385a1f4ef3448d59fd0
MD5 fc527ec32efc839141a61ba039861a6d
SHA1 ea066aeb55ce589fd796c620554c5156c7550a5e
SHA512 da8cde4f084ab696e45e50a9e7b0bc1bc62c0109b95b22bf2a614f9323c2f1eb1fd08362f57ca53753c79a1d5e89bf539141931fd4eccd65e0d2f47d9065f94d
SSDEEP 49152:suI2h0r8SQ0v+Ew1+xUvGlazQi1PoBvwttmxEPzAY:s5O0r8/EY+xUvRQi1PoBv8tIPY
TLSH
T1CDC5E03FF28B653EE06A2A3639B2A250543B7E6164124C4696ECF48CCF355B01D3E797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5340	RecFlareSetup.tmp
5800	DepotDownloader.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	DepotDownloader.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RecFlareSetup.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RecFlareSetup.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DepotDownloader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DepotDownloader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecFlareSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecFlareSetup.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/6060-1-0x0000000000160000-0x000000000027D000-memory.dmp	innosetup
behavioral1/memory/6060-10-0x0000000000160000-0x000000000027D000-memory.dmp	innosetup

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	DepotDownloader.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5340	RecFlareSetup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6060 wrote to memory of 5340	6060	RecFlareSetup.exe	84
PID 5340 wrote to memory of 1916	5340	RecFlareSetup.tmp	100
PID 5340 wrote to memory of 5800	5340	RecFlareSetup.tmp	103

C:\Users\Admin\AppData\Local\Temp\RecFlareSetup.exe
"C:\Users\Admin\AppData\Local\Temp\RecFlareSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6060
- C:\Users\Admin\AppData\Local\Temp\is-0Q0JZVZ4FO.tmp\RecFlareSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0Q0JZVZ4FO.tmp\RecFlareSetup.tmp" /SL5="$502F2,1262241,1106432,C:\Users\Admin\AppData\Local\Temp\RecFlareSetup.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5340
- - C:\Windows\SysWOW64\tar.exe
    "C:\Windows\system32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\is-Q9TA102GXX.tmp\DepotDownloader.zip" -C "C:\Users\Admin\AppData\Local\Temp\is-Q9TA102GXX.tmp\DepotDownloader"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\is-Q9TA102GXX.tmp\DepotDownloader\DepotDownloader.exe
    "C:\Users\Admin\AppData\Local\Temp\is-Q9TA102GXX.tmp\DepotDownloader\DepotDownloader.exe" -app 471710 -depot 471711 -manifest 1151455856673601091 -remember-password -dir "C:\Games\RecFlare" -qr
    3⤵
    - Executes dropped EXE
    - Direct Volume Access: Opens a physical disk for reading
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

1

T1006

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RecFlareSetup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-0Q0JZVZ4FO.tmp\RecFlareSetup.tmp
Size 4.4MB
SHA256 7b1c0475f029653b6130afdfc7bae0917d63f90747e01510bd2a109d356b0eb6
MD5 2e9cb5c2e1bfd78567231dcd494836b5
SHA1 dcbbfa30b7d0bc2f9f746b0d514e76cf2b897997
SHA512 ab61512c15c2294326e1db621cf0ba6df9d3aad34702e86eb649fb2e8d78070a03dba0e1a1818590037dd5aaac1aee88b8f1d1b92886a37dc488b6d295d5b5b5
SSDEEP 98304:HYU5hnuOajWwMPdCpepI3GrwrA+Jh333PLr8t:xxuHjWfZIz9LM
TLSH
T16E268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DepotDownloader.zip

Path C:\Users\Admin\AppData\Local\Temp\is-Q9TA102GXX.tmp\DepotDownloader.zip
Size 31.9MB
SHA256 41c9e9f0df54b3ad02e67a11726756e5c73283bd7c2e1b04acfa5ae4c2ed3767
MD5 86148741b162a9830349b8e6072ae790
SHA1 6649779d27284a80c00e8a2a9d448d22fc27f9aa
SHA512 0e88c50c80d404722d685f05907718c9e73e28358de53b3ffe37914bc5bc36f65651e27c4dfe33d47483e8bce1f87ace7185c70eb902e3db0852c5f8f76448c0
SSDEEP 786432:3wIQ5P5WF8VfhHI+jNkrhWLM7DKYLmKZ7qrRGDlRgz73DQtU6xspSLzEZeQZiz:3fQ5xGEo+WcAqYLm0PlLU60SLQnZiz
TLSH
T1A27733B40DF3941B353BD627E82C58E965948C73DD99083D7D22C6A906892C1CABDFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5340-5-0x0000000001BD0000-0x0000000001BD1000-memory.dmp

Download

memory/5340-11-0x0000000000D00000-0x0000000001171000-memory.dmp

Download

memory/5340-20-0x0000000001BD0000-0x0000000001BD1000-memory.dmp

Download

memory/5340-23-0x0000000000D00000-0x0000000001171000-memory.dmp

Download

memory/6060-1-0x0000000000160000-0x000000000027D000-memory.dmp

Download

memory/6060-10-0x0000000000160000-0x000000000027D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads