Analysis

  • max time kernel
    98s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 04:30

General

  • Target

    974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe

  • Size

    216KB

  • MD5

    3b23e12bff983d52dbca22c700e9338a

  • SHA1

    52dcde5bc8934ab70b76a21f6a559626129834c6

  • SHA256

    974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19

  • SHA512

    991fd833b1a3363680fa35cf709c39a9bce426d6e6e0d0453b7fe263a5b0f2174f9eacdc8e03d468c6001e2b25f4eb1a27b391fcb05ad0237d6cab6397740426

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 11 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe
    "C:\Users\Admin\AppData\Local\Temp\974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3900
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd0) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:408
      • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
        C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd0)
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        PID:4484
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd1) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4912
      • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
        C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd1)
        3⤵
        • Executes dropped EXE
        PID:524
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd2) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
        C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd2)
        3⤵
        • Executes dropped EXE
        PID:1420
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd3) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
        C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd3)
        3⤵
        • Executes dropped EXE
        PID:4208
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd4) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:608
      • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
        C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd4)
        3⤵
        • Executes dropped EXE
        PID:2324
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd5) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
        C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd5)
        3⤵
        • Executes dropped EXE
        PID:2704
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd6) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
        C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd6)
        3⤵
        • Executes dropped EXE
        PID:3560
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd7) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4044
      • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
        C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd7)
        3⤵
        • Executes dropped EXE
        PID:4680
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd8) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
        C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd8)
        3⤵
        • Executes dropped EXE
        PID:2940
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd9) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4944
      • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
        C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd9)
        3⤵
        • Executes dropped EXE
        PID:3908
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd10) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4624
      • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
        C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd10)
        3⤵
        • Executes dropped EXE
        PID:4476

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
    Filesize

    45KB

    MD5

    a1d33b80e8d5b80ed549811fd3070018

    SHA1

    1967be963184532df6af0a126d26c6a9798a4ad6

    SHA256

    fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219

    SHA512

    d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514

  • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
    Filesize

    45KB

    MD5

    a1d33b80e8d5b80ed549811fd3070018

    SHA1

    1967be963184532df6af0a126d26c6a9798a4ad6

    SHA256

    fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219

    SHA512

    d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514

  • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
    Filesize

    45KB

    MD5

    a1d33b80e8d5b80ed549811fd3070018

    SHA1

    1967be963184532df6af0a126d26c6a9798a4ad6

    SHA256

    fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219

    SHA512

    d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514

  • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
    Filesize

    45KB

    MD5

    a1d33b80e8d5b80ed549811fd3070018

    SHA1

    1967be963184532df6af0a126d26c6a9798a4ad6

    SHA256

    fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219

    SHA512

    d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514

  • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
    Filesize

    45KB

    MD5

    a1d33b80e8d5b80ed549811fd3070018

    SHA1

    1967be963184532df6af0a126d26c6a9798a4ad6

    SHA256

    fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219

    SHA512

    d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514

  • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
    Filesize

    45KB

    MD5

    a1d33b80e8d5b80ed549811fd3070018

    SHA1

    1967be963184532df6af0a126d26c6a9798a4ad6

    SHA256

    fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219

    SHA512

    d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514

  • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
    Filesize

    45KB

    MD5

    a1d33b80e8d5b80ed549811fd3070018

    SHA1

    1967be963184532df6af0a126d26c6a9798a4ad6

    SHA256

    fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219

    SHA512

    d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514

  • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
    Filesize

    45KB

    MD5

    a1d33b80e8d5b80ed549811fd3070018

    SHA1

    1967be963184532df6af0a126d26c6a9798a4ad6

    SHA256

    fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219

    SHA512

    d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514

  • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
    Filesize

    45KB

    MD5

    a1d33b80e8d5b80ed549811fd3070018

    SHA1

    1967be963184532df6af0a126d26c6a9798a4ad6

    SHA256

    fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219

    SHA512

    d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514

  • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
    Filesize

    45KB

    MD5

    a1d33b80e8d5b80ed549811fd3070018

    SHA1

    1967be963184532df6af0a126d26c6a9798a4ad6

    SHA256

    fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219

    SHA512

    d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514

  • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
    Filesize

    45KB

    MD5

    a1d33b80e8d5b80ed549811fd3070018

    SHA1

    1967be963184532df6af0a126d26c6a9798a4ad6

    SHA256

    fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219

    SHA512

    d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514

  • C:\Users\Admin\AppData\Local\Temp\mtldrinst.exe
    Filesize

    45KB

    MD5

    a1d33b80e8d5b80ed549811fd3070018

    SHA1

    1967be963184532df6af0a126d26c6a9798a4ad6

    SHA256

    fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219

    SHA512

    d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514

  • C:\Users\Admin\AppData\Local\Temp\tempch.tmp
    Filesize

    96B

    MD5

    107fcbd4d9c40561fe52e5f95fc99c61

    SHA1

    180e0fde39d11d683ee621838a1b5275dcb6a743

    SHA256

    c669aa6bd63c5772beabf37cf45f0e24de34df0474f39a8aabaee616165d45ce

    SHA512

    3f4a0c5d1fc162718a2f5dc7fb1aefa0fd040cdd9c079bc9f367aa2f19367229e843fe75a9e1984f27c7b746ec396bc1f1348074458e5e5923afc82f54b8994e

  • memory/408-132-0x0000000000000000-mapping.dmp
  • memory/524-138-0x0000000000000000-mapping.dmp
  • memory/608-146-0x0000000000000000-mapping.dmp
  • memory/760-140-0x0000000000000000-mapping.dmp
  • memory/1420-141-0x0000000000000000-mapping.dmp
  • memory/1680-149-0x0000000000000000-mapping.dmp
  • memory/2324-147-0x0000000000000000-mapping.dmp
  • memory/2696-152-0x0000000000000000-mapping.dmp
  • memory/2704-150-0x0000000000000000-mapping.dmp
  • memory/2876-143-0x0000000000000000-mapping.dmp
  • memory/2940-159-0x0000000000000000-mapping.dmp
  • memory/3560-153-0x0000000000000000-mapping.dmp
  • memory/3908-162-0x0000000000000000-mapping.dmp
  • memory/4044-155-0x0000000000000000-mapping.dmp
  • memory/4208-144-0x0000000000000000-mapping.dmp
  • memory/4476-165-0x0000000000000000-mapping.dmp
  • memory/4484-133-0x0000000000000000-mapping.dmp
  • memory/4624-164-0x0000000000000000-mapping.dmp
  • memory/4680-156-0x0000000000000000-mapping.dmp
  • memory/4912-137-0x0000000000000000-mapping.dmp
  • memory/4944-161-0x0000000000000000-mapping.dmp
  • memory/4948-158-0x0000000000000000-mapping.dmp