0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75

General

Target

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
Size

237KB
MD5

63bb49f37aa25a2c83b1fd2040ca162e
SHA1

e5f7b42635fedb27f5627989a621d8ca486c35fa
SHA256

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75
SHA512

7811e1fe99bb835490193c5848468f03725821a29cde561356876ffdee3a10d338d59bc410c3e7fcb053eceb1ee1606feeae18a13c6a2d534e27ad8a2dcc3e5d

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

description ioc process

File opened for modification \??\PhysicalDrive0 0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

description	pid	process	target process
PID 2036 set thread context of 1224	2036	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

Modifies registry class 3 IoCs

Processes:

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

pid	process
1224	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
1224	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

pid process

2036 0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

pid	process
2036	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

description	pid	process	target process
PID 2036 wrote to memory of 1224	2036	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 2036 wrote to memory of 1224	2036	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 2036 wrote to memory of 1224	2036	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 2036 wrote to memory of 1224	2036	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 2036 wrote to memory of 1224	2036	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 2036 wrote to memory of 1224	2036	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 2036 wrote to memory of 1224	2036	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 2036 wrote to memory of 1224	2036	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 1224 wrote to memory of 1200	1224	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	Explorer.EXE
PID 1224 wrote to memory of 1200	1224	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	Explorer.EXE
PID 1224 wrote to memory of 1200	1224	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	Explorer.EXE
PID 1224 wrote to memory of 1200	1224	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
  "C:\Users\Admin\AppData\Local\Temp\0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Users\Admin\AppData\Local\Temp\0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
    C:\Users\Admin\AppData\Local\Temp\0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-60-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1224-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1224-57-0x0000000000407A4D-mapping.dmp

Download
memory/1224-59-0x0000000075C01000-0x0000000075C03000-memory.dmp

Filesize
8KB

Download
memory/1224-63-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1224-64-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads