Analysis
-
max time kernel
99s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
26-06-2022 05:22
Static task
static1
Behavioral task
behavioral1
Sample
boomclnr.exe
Resource
win7-20220414-en
General
-
Target
boomclnr.exe
-
Size
338KB
-
MD5
7eb3288cf5a21f9e579741af49ce65aa
-
SHA1
15ee11f73dd90eb20e5dcca2ad8fac94f93a91c1
-
SHA256
d080f227320c4939dd03587024c17583d8fe7b589e45502f8ee905ecb33d626a
-
SHA512
e733a472ed1c2d3e848fc12eaab52a877a4e81382bba85674d061b0e34060186377e5399b9d67596fca1fe0813d1c960a851702abbac015955bc18df7cc5012a
Malware Config
Extracted
arkei
Default
Signatures
-
suricata: ET MALWARE Win32/Vidar Variant/Mars CnC Activity (GET)
suricata: ET MALWARE Win32/Vidar Variant/Mars CnC Activity (GET)
-
suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
uf8.0.exepid process 956 uf8.0.exe -
Loads dropped DLL 7 IoCs
Processes:
boomclnr.exeuf8.0.exepid process 548 boomclnr.exe 548 boomclnr.exe 548 boomclnr.exe 548 boomclnr.exe 548 boomclnr.exe 956 uf8.0.exe 956 uf8.0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
uf8.0.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 uf8.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString uf8.0.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1672 timeout.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b000000000200000000001066000000010000200000002bb0ff63bf7bc01890226fbb10c380a85b7bdd138560e6ec0b56b103c1d35b06000000000e800000000200002000000038b3623238d713c2f0bea23704d53171a2a1b9f08704f1c749a7963da69fe146200000003a970ec3d9e53ac0dc902928aecda0a5de896b64c0bbf8d1f5a252714c1cbdd14000000088bb34de8a6e6d1e7e90f14d4195225919a083703945ce871f7e65f0d553f80389c32ad8c11a1bd634d24c33e1bab54621f5c89617126410dd94b347a396057e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404824ec1c89d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b000000000200000000001066000000010000200000005674768bd37fdb2da15482bd3397085e6315b5808316ffd9feb70d6e9fc6434e000000000e80000000020000200000000e121722e0b8895601d63c7fea52dedf226a10d2619d831950dcc0b4bf09967390000000f8ed3ec89ab2e26c0dbb7a665c495026a672bd5455107f02e68341d8336e20f1504a778d87a823a8589f49a0fb0c950a735830fa13e926a00d16a8ebfb7d764ede328b7577a14d923ba1f52e212671c65ef644c4ada20750ad4d2195b2d7ad4af524cab5db548af2d4e72fcfd48ca195289727ff1fc95933c689daa62e788ce2246b469d133da34cb1c4ebf6205ae5b4400000006fa9e3603c3dc0289f6e016818c37cf87b559e411868bfb41abc3ecb5137f77c5f91a1f74352048058d26db6bdde18a2e0b691cc32fb265c69b3b4c557810979 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "362985967" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{127C7941-F510-11EC-8749-4224C87335A1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1432 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1432 iexplore.exe 1432 iexplore.exe 1808 IEXPLORE.EXE 1808 IEXPLORE.EXE 1808 IEXPLORE.EXE 1808 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
boomclnr.exeiexplore.exeuf8.0.exedescription pid process target process PID 548 wrote to memory of 956 548 boomclnr.exe uf8.0.exe PID 548 wrote to memory of 956 548 boomclnr.exe uf8.0.exe PID 548 wrote to memory of 956 548 boomclnr.exe uf8.0.exe PID 548 wrote to memory of 956 548 boomclnr.exe uf8.0.exe PID 548 wrote to memory of 1432 548 boomclnr.exe iexplore.exe PID 548 wrote to memory of 1432 548 boomclnr.exe iexplore.exe PID 548 wrote to memory of 1432 548 boomclnr.exe iexplore.exe PID 548 wrote to memory of 1432 548 boomclnr.exe iexplore.exe PID 1432 wrote to memory of 1808 1432 iexplore.exe IEXPLORE.EXE PID 1432 wrote to memory of 1808 1432 iexplore.exe IEXPLORE.EXE PID 1432 wrote to memory of 1808 1432 iexplore.exe IEXPLORE.EXE PID 1432 wrote to memory of 1808 1432 iexplore.exe IEXPLORE.EXE PID 956 wrote to memory of 1512 956 uf8.0.exe cmd.exe PID 956 wrote to memory of 1512 956 uf8.0.exe cmd.exe PID 956 wrote to memory of 1512 956 uf8.0.exe cmd.exe PID 956 wrote to memory of 1512 956 uf8.0.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\boomclnr.exe"C:\Users\Admin\AppData\Local\Temp\boomclnr.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uf8.0.exe"C:\Users\Admin\AppData\Local\Temp\uf8.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\uf8.0.exe" & exit3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://yip.su/2N19t72⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1432 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\uf8.0.exeFilesize
353KB
MD5b4313a7d7629f36f75f7c964cddb407a
SHA1b6067c17671743fb93d4783e7925b1c24393e0ac
SHA2565d2852480a44eed596c7211a6eab77bee91653293aacbd39d4f47b45946740c2
SHA5127dfeee2affd3f5a71abe63d5c866b29c36373683fb7ca5b4ce8e4fc0d122dc64ce4fe0a3e252c3fbd8a9b59b90e8af9a627c25fcc9fe1991444a4b15c2332e21
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BD7RXBDA.txtFilesize
605B
MD5628677adca676b684eccb5f05cd6eef9
SHA107730088fa67c611da0d3123072320592f833085
SHA256a70fb7021efdd93164fdbe3f2188b716e12ca92513af7139d74ecfad711bab4e
SHA5122ad9e7224bbea615a59353f62648e9844aaa21ee4ed5e28cebd61ce46190fe033729cc047b8dd20eaa925110943da86a5fd785e9601533c68b37f3e8deb1d88e
-
\ProgramData\mozglue.dllFilesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\nss3.dllFilesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\Users\Admin\AppData\Local\Temp\uf8.0.exeFilesize
353KB
MD5b4313a7d7629f36f75f7c964cddb407a
SHA1b6067c17671743fb93d4783e7925b1c24393e0ac
SHA2565d2852480a44eed596c7211a6eab77bee91653293aacbd39d4f47b45946740c2
SHA5127dfeee2affd3f5a71abe63d5c866b29c36373683fb7ca5b4ce8e4fc0d122dc64ce4fe0a3e252c3fbd8a9b59b90e8af9a627c25fcc9fe1991444a4b15c2332e21
-
\Users\Admin\AppData\Local\Temp\uf8.0.exeFilesize
353KB
MD5b4313a7d7629f36f75f7c964cddb407a
SHA1b6067c17671743fb93d4783e7925b1c24393e0ac
SHA2565d2852480a44eed596c7211a6eab77bee91653293aacbd39d4f47b45946740c2
SHA5127dfeee2affd3f5a71abe63d5c866b29c36373683fb7ca5b4ce8e4fc0d122dc64ce4fe0a3e252c3fbd8a9b59b90e8af9a627c25fcc9fe1991444a4b15c2332e21
-
\Users\Admin\AppData\Local\Temp\uf8.0.exeFilesize
353KB
MD5b4313a7d7629f36f75f7c964cddb407a
SHA1b6067c17671743fb93d4783e7925b1c24393e0ac
SHA2565d2852480a44eed596c7211a6eab77bee91653293aacbd39d4f47b45946740c2
SHA5127dfeee2affd3f5a71abe63d5c866b29c36373683fb7ca5b4ce8e4fc0d122dc64ce4fe0a3e252c3fbd8a9b59b90e8af9a627c25fcc9fe1991444a4b15c2332e21
-
\Users\Admin\AppData\Local\Temp\uf8.0.exeFilesize
353KB
MD5b4313a7d7629f36f75f7c964cddb407a
SHA1b6067c17671743fb93d4783e7925b1c24393e0ac
SHA2565d2852480a44eed596c7211a6eab77bee91653293aacbd39d4f47b45946740c2
SHA5127dfeee2affd3f5a71abe63d5c866b29c36373683fb7ca5b4ce8e4fc0d122dc64ce4fe0a3e252c3fbd8a9b59b90e8af9a627c25fcc9fe1991444a4b15c2332e21
-
\Users\Admin\AppData\Local\Temp\uf8.1.exeFilesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
memory/548-54-0x0000000076181000-0x0000000076183000-memory.dmpFilesize
8KB
-
memory/956-62-0x0000000000BF8000-0x0000000000C19000-memory.dmpFilesize
132KB
-
memory/956-65-0x0000000000400000-0x0000000000B4B000-memory.dmpFilesize
7.3MB
-
memory/956-67-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/956-64-0x00000000002C0000-0x00000000002E9000-memory.dmpFilesize
164KB
-
memory/956-63-0x0000000000BF8000-0x0000000000C19000-memory.dmpFilesize
132KB
-
memory/956-89-0x0000000000BF8000-0x0000000000C19000-memory.dmpFilesize
132KB
-
memory/956-90-0x0000000000400000-0x0000000000B4B000-memory.dmpFilesize
7.3MB
-
memory/956-59-0x0000000000000000-mapping.dmp
-
memory/1512-88-0x0000000000000000-mapping.dmp