Analysis
-
max time kernel
141s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 21:46
Static task
static1
Behavioral task
behavioral1
Sample
3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe
Resource
win10v2004-20220414-en
General
-
Target
3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe
-
Size
2.5MB
-
MD5
ed5c9f7413ea2a90ee2b68177722b19d
-
SHA1
b67fd00fb901db3df57effc3eb6b08b1bbd07e88
-
SHA256
3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d
-
SHA512
2773d591b09b514a1fea98090f56575453bfa56fee87c007d0d1d535f8b0b660b245cd02892719ea9a698a780af89cb63a98596f233c2b6a871196b97ef8fc73
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exedescription ioc process File opened for modification \??\PhysicalDrive0 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exepid process 4764 ipconfig.exe 1332 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exepid process 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exepid process 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exedescription pid process target process PID 4328 wrote to memory of 4764 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe ipconfig.exe PID 4328 wrote to memory of 4764 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe ipconfig.exe PID 4328 wrote to memory of 4764 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe ipconfig.exe PID 4328 wrote to memory of 1332 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe ipconfig.exe PID 4328 wrote to memory of 1332 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe ipconfig.exe PID 4328 wrote to memory of 1332 4328 3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe ipconfig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe"C:\Users\Admin\AppData\Local\Temp\3be53078552b1c2cdb0d81afa62768c2de793a7ddaef864249c297117227c12d.exe"1⤵
- Drops file in Drivers directory
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc1⤵