Managed XDR

rlsoption.exe — malware analysis report

File info

Filename
rlsoption.exe
File type
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
File size
215 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
e8d39569d2f516a864ef5de06af292176b61c9aa
SHA256
5fa1081c06db7472400405d671756ed2b23532e225f9f324f3a2980490bdda4d
MD5
873877d50cc0166909148a9ab065a5b0

Signatures

Execution

T1059.001 suspicious_powershell: Creates suspicious powershell process
T1059 network_wscript_downloader: Wscript.exe initiated network communication
T1059.001 suspicious_process: Spawns a suspicious process
T1059.003 suspicious_process: Spawns a suspicious process
T1047 has_wmi: Executes one or several WMI requests
T1059.005 obfuscated_vbs: Detected obfuscated VBS
T1059 wscript_info_discovery: Collects info about system with Wscript.Shell

Persistence

T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key

Privilege Escalation

T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1562.001 disables_security: Disables Windows Security options
T1562 modify_uac_prompt: Attempts to modify UAC pop-up window behavior
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1574.011 persistence_services: Modifies Services registry key
T1027 obfuscated_vbs: Detected obfuscated VBS
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1070 stealth_window: A process created a hidden window

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Discovery

T1518.001 antiav_detectservice: Attempts to detect installed antiviruses by a certain service
T1007 has_wmi: Executes one or several WMI requests
T1518 locates_browser: Attempts to identify where browsers are installed
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1082 wscript_info_discovery: Collects info about system with Wscript.Shell
T1033 wscript_info_discovery: Collects info about system with Wscript.Shell

Command and Control

T1071 network_wscript_downloader: Wscript.exe initiated network communication
T1102.003 cloud_github: Connects to cloud services of Github (potentially for malicious payload delivery)
T1071.001 network_http: Performs HTTP requests
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Impact

T1489 stops_service: Stops Windows services
T1485 deletes_files: Removes 100 or more files from C: drive

Other

yara_rules: Static rules
creates_exe: Creates executable files in the file system
create_process_failed: Could not start the process
executes_dropped_exe: Executes dropped exe files
require_administrator: Requests administrator privileges
creates_suspended_process: Creates suspended process
break_limit_exceeded: Warning: function calls limit has been exceeded
message_box: Displays a message
get_policy_info: Retrieves information about a Policy object
suricata_alert: Malicious traffic detected