3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d

General

Target

3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe
Size

2.5MB
MD5

ed5c9f7413ea2a90ee2b68177722b19d
SHA1

b67fd00fb901db3df57effc3eb6b08b1bbd07e88
SHA256

3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d
SHA512

2773d591b09b514a1fea98090f56575453bfa56fee87c007d0d1d535f8b0b660b245cd02892719ea9a698a780af89cb63a98596f233c2b6a871196b97ef8fc73

Score

8^/10

bootkit persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe

description ioc process

File opened for modification \??\PhysicalDrive0 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

1696 ipconfig.exe
1704 ipconfig.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe

pid	process
1696	ipconfig.exe
1704	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe

pid process

876 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe

pid	process
876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe
876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe
876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe
876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe
876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe
876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe

description	pid	process	target process
PID 876 wrote to memory of 1696	876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe	ipconfig.exe
PID 876 wrote to memory of 1696	876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe	ipconfig.exe
PID 876 wrote to memory of 1696	876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe	ipconfig.exe
PID 876 wrote to memory of 1696	876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe	ipconfig.exe
PID 876 wrote to memory of 1704	876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe	ipconfig.exe
PID 876 wrote to memory of 1704	876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe	ipconfig.exe
PID 876 wrote to memory of 1704	876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe	ipconfig.exe
PID 876 wrote to memory of 1704	876	3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe	ipconfig.exe

C:\Users\Admin\AppData\Local\Temp\3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe
"C:\Users\Admin\AppData\Local\Temp\3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe"
1⤵
- Drops file in Drivers directory
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
2⤵
- Gathers network information
PID:1696

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
2⤵
- Gathers network information
PID:1704

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1696-55-0x0000000000000000-mapping.dmp

Download
memory/1704-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads