a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776

General

Target

a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe
Size

2.4MB
MD5

dc443bac4fcb66bbbba26bb3554c2b55
SHA1

971ece1f04fa5593ec787fc3838a1ce1255860d8
SHA256

a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776
SHA512

03a0b6e5320405db14f2d07476600e3886eb562f413b48a0f306f25325af54fc322b5b9c9ddc26c141b9bf0da873007ab3dc8712b7e390fff6ac7decae93489d

Score

8^/10

bootkit persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe

description ioc process

File opened for modification \??\PhysicalDrive0 a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

3716 ipconfig.exe
5052 ipconfig.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe

pid	process
3716	ipconfig.exe
5052	ipconfig.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe

pid	process
4088	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe
4088	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe
4088	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe
4088	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe
4088	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe
4088	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe

description	pid	process	target process
PID 4088 wrote to memory of 3716	4088	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe	ipconfig.exe
PID 4088 wrote to memory of 3716	4088	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe	ipconfig.exe
PID 4088 wrote to memory of 3716	4088	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe	ipconfig.exe
PID 4088 wrote to memory of 5052	4088	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe	ipconfig.exe
PID 4088 wrote to memory of 5052	4088	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe	ipconfig.exe
PID 4088 wrote to memory of 5052	4088	a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe	ipconfig.exe

C:\Users\Admin\AppData\Local\Temp\a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe
"C:\Users\Admin\AppData\Local\Temp\a56ec9c918695cc0e5018ac4805df2120f9dcb8eaf9aa19489ae484b02518776.exe"
1⤵
- Drops file in Drivers directory
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:3716
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:5052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-130-0x0000000000000000-mapping.dmp

Download
memory/5052-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads