RiftLoaderV4 (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RiftLoaderV4 (1).exe
Size 45.8MB
Sample261107-slphfsyx2k
SHA256 e0061d75c9859208de81e0835a6bade6b71125cbf72afc557e54fb28a4deafbb
MD5 c3482ee3cdb11fd1fbd16cf696888bcc
SHA1 cd19749bc394c17a4c2f6154fc6e22d2827aea72
SHA512 bd0bbad189f1baab40ee606ce8dc5d4a87b755fa438d5cf98db8816149c1bac8c89b885a56aa7fb631b4f2b726b3bb3ed5f04c57c7ac0facb110dc38b9dfffec
SSDEEP 786432:OUxz8ypDkmzWfKMX+zVgD07DM2HKzG755p7o9gMkXL:OUxgypfzWfKHgg8Zg5L7ogn
TLSH
T13CB702D6F89502D4C7438678454F534BA2A1F0A553A852BF36CA44532D32FDA8EFBF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RiftLoaderV4 (1).exe

File Explorer

RiftLoaderV4 (1).exe

.exe 45.8MB

RiftLoaderV4 (1).exe

IMPHASH b5849bd2088a738a34211f5a74d5f66a
SHA256 e0061d75c9859208de81e0835a6bade6b71125cbf72afc557e54fb28a4deafbb
MD5 c3482ee3cdb11fd1fbd16cf696888bcc
SHA1 cd19749bc394c17a4c2f6154fc6e22d2827aea72
SHA512 bd0bbad189f1baab40ee606ce8dc5d4a87b755fa438d5cf98db8816149c1bac8c89b885a56aa7fb631b4f2b726b3bb3ed5f04c57c7ac0facb110dc38b9dfffec
SSDEEP 786432:OUxz8ypDkmzWfKMX+zVgD07DM2HKzG755p7o9gMkXL:OUxgypfzWfKHgg8Zg5L7ogn
TLSH
T13CB702D6F89502D4C7438678454F534BA2A1F0A553A852BF36CA44532D32FDA8EFBF22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8907760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ntdll

RtlUnwindEx RtlPcToFileHeader VerSetConditionMask RtlUnwind RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtWriteFile RtlNtStatusToDosError

ws2_32

inet_ntoa getservbyport getservbyname gethostbyname gethostname inet_addr htonl __WSAFDIsSet WSAIoctl WSASetLastError ntohs socket htons WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSACleanup WSAStartup sendto recvfrom select connect listen bind getsockname getpeername send shutdown recv accept ioctlsocket setsockopt getsockopt freeaddrinfo getaddrinfo closesocket WSAGetLastError gethostbyaddr

winhttp

WinHttpCloseHandle WinHttpSetOption WinHttpWebSocketShutdown WinHttpWebSocketSend WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpWebSocketReceive WinHttpConnect WinHttpCrackUrl WinHttpWebSocketCompleteUpgrade WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertGetNameStringW CertFindExtension CertFreeCTLContext CertAddCertificateContextToStore CertOpenSystemStoreW CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore CertGetSubjectCertificateFromStore CertGetNameStringA CryptMsgGetParam CertFreeCRLContext CertCreateCertificateChainEngine CertCloseStore CryptQueryObject CertFreeCertificateContext CryptMsgClose CryptProtectData CryptUnprotectData

wintrust

WinVerifyTrust

advapi32

CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource CryptEncrypt CryptAcquireContextW AdjustTokenPrivileges LookupPrivilegeValueA CredWriteW CredReadW CredFree RegCreateKeyExW RegSetValueExA CryptDestroyKey CryptAcquireContextA CryptCreateHash CryptHashData CryptSetHashParam CryptDestroyHash CryptImportKey CryptGetHashParam CryptReleaseContext SetSecurityDescriptorDacl SetEntriesInAclW OpenProcessToken InitializeSecurityDescriptor SetSecurityDescriptorControl GetTokenInformation RegOpenKeyExW RegQueryValueExW RegCloseKey RegQueryValueExA AllocateAndInitializeSid FreeSid CheckTokenMembership

bcrypt

BCryptGenRandom

user32

GetCapture SetWindowLongA ClientToScreen IsChild TrackMouseEvent GetKeyboardLayout GetMonitorInfoA GetForegroundWindow GetPropA SetLayeredWindowAttributes SetFocus BringWindowToTop SetCapture SetCursor SetWindowLongW IsWindowUnicode SetWindowLongPtrA ReleaseCapture SetForegroundWindow SetCursorPos ReleaseDC GetCursorPos EmptyClipboard SetClipboardData OpenClipboard CloseClipboard GetClipboardData DefWindowProcW PostMessageW WindowFromPoint SetWindowPos SetWindowRgn CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetProcessWindowStation SetTimer PeekMessageW MsgWaitForMultipleObjectsEx TranslateMessage GetClientRect KillTimer PostQuitMessage UpdateWindow IsIconic MessageBoxA FindWindowA MessageBoxW GetUserObjectInformationW EnumDisplayMonitors MonitorFromWindow GetDC LoadCursorA SetPropA GetMessageExtraInfo GetKeyState AdjustWindowRectEx DestroyWindow GetWindowLongW DispatchMessageW

kernel32

FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SetStdHandle SystemTimeToTzSpecificLocalTime FlsGetValue FlsAlloc InitializeSListHead LoadLibraryExW IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount RaiseException WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter SetConsoleCtrlHandler FlsSetValue ReadConsoleA GetStartupInfoW TryAcquireSRWLockExclusive GetLocaleInfoEx GetFileAttributesExW AreFileApisANSI CopyFileW EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetEndOfFile IsValidCodePage GetOEMCP HeapSize GetCPInfo GetCommandLineA FlsFree SetConsoleMode FindFirstFileW SystemTimeToFileTime GetSystemTime LoadLibraryW CreateSemaphoreA ReleaseSemaphore InitializeCriticalSection GetACP GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc AcquireSRWLockShared ReleaseSRWLockShared InitializeSRWLock VerifyVersionInfoW PeekNamedPipe FormatMessageA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FindNextFileW SleepEx WaitForMultipleObjects GetConsoleOutputCP GetStdHandle WriteConsoleW ReadConsoleW HeapAlloc GetFullPathNameW SetEnvironmentVariableW GetConsoleMode FindClose FindFirstFileExW GetFileInformationByHandleEx GetFinalPathNameByHandleW CreateDirectoryW GetCurrentDirectoryW GetSystemFirmwareTable GetLastError GetTickCount64 CloseHandle VirtualQuery GetCurrentProcess ReadProcessMemory FreeEnvironmentStringsW ExitProcess GetModuleHandleW GetEnvironmentStringsW ReadFile GetModuleFileNameA Process32First VirtualProtect SetLastError VirtualFree GetCommandLineW OutputDebugStringA VirtualAlloc TerminateProcess GetModuleFileNameW Module32Next CreateMutexA Module32First GetCurrentThreadId ReleaseMutex GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetFileAttributesA Process32NextW QueryFullProcessImageNameA CreateFileA GetCurrentThread GetSystemDirectoryA LoadLibraryA QueryPerformanceFrequency Process32Next Process32FirstW CreateThread AddVectoredExceptionHandler GetThreadContext GetProcAddress LocalFree GetCurrentProcessId FreeLibrary FlushInstructionCache WideCharToMultiByte lstrcmpW IsDebuggerPresent CheckRemoteDebuggerPresent SizeofResource GetFileSizeEx WriteProcessMemory WriteFile CompareStringOrdinal FindResourceA GetEnvironmentVariableA CreateFileW GetFileAttributesW ResumeThread GetFileInformationByHandle GetTempPathA SetFileInformationByHandle LockResource DeleteFileA DeleteFileW LoadResource FindResourceW VirtualProtectEx MoveFileExW CreateProcessW GetFileType GetDiskFreeSpaceExA QueryPerformanceCounter FlushFileBuffers GetExitCodeProcess GetLogicalDrives ExpandEnvironmentStringsW GetEnvironmentVariableW MultiByteToWideChar SetFilePointerEx QueryFullProcessImageNameW GetDriveTypeW CreateNamedPipeW GetNamedPipeClientProcessId WaitForSingleObject LocalAlloc DisconnectNamedPipe CreateEventW CancelIoEx ResetEvent GetOverlappedResult ConnectNamedPipe GetLocalTime CreateDirectoryA GetSystemTimeAsFileTime GetProcessTimes CancelSynchronousIo GetVolumeInformationW DeviceIoControl GetExitCodeThread VirtualAllocEx CreateRemoteThread VirtualFreeEx Module32FirstW Module32NextW GetWindowsDirectoryA GlobalLock GlobalUnlock GlobalAlloc GlobalFree GetLocaleInfoA IsDBCSLeadByte GetProcessHeap HeapFree HeapReAlloc lstrlenW WaitForSingleObjectEx

ole32

CoTaskMemFree CoInitializeEx CoUninitialize

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute

secur32

InitSecurityInterfaceW

shell32

ShellExecuteExW ShellExecuteA CommandLineToArgvW ShellExecuteW SHGetFolderPathA SHGetKnownFolderPath

comdlg32

GetOpenFileNameW

gdi32

GetDeviceCaps CreateRoundRectRgn

iphlpapi

if_nametoindex GetAdaptersAddresses

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

Name

.text

Size

8.8MB

Virtual Size

8.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

197KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.l9j

Size

33.5MB

Virtual Size

33.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RiftLoaderV4 (1).exe

api-ms-win-core-synch-l1-2-0

ntdll

ws2_32

winhttp

crypt32

wintrust

advapi32

bcrypt

user32

kernel32

ole32

d3d11

d3dcompiler_47

dwmapi

secur32

shell32

comdlg32

gdi32

iphlpapi

rpcrt4

imm32

generic