Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 18:07
Static task
static1
Behavioral task
behavioral1
Sample
4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe
Resource
win7-20220718-en
General
-
Target
4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe
-
Size
120KB
-
MD5
7cd51ed7687a080cbf8cb1ce8c809822
-
SHA1
f5287b9f5ebfc74b63d9d059be5684c8bf05e583
-
SHA256
4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe
-
SHA512
131ec0c2c25f0a946d16553115fdd6a347b87d73b73b9ee514bfc4148e09249186cc1a64e9931ea0a3b42516fc60f62b7072e1cd5784d78e834b53fd3a73a255
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exeboostdroid.exeboostdroid.exepid process 4128 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 4128 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 4704 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 4704 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 2628 boostdroid.exe 2628 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe 2292 boostdroid.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exepid process 4704 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exeboostdroid.exedescription pid process target process PID 4128 wrote to memory of 4704 4128 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe PID 4128 wrote to memory of 4704 4128 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe PID 4128 wrote to memory of 4704 4128 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe 4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe PID 2628 wrote to memory of 2292 2628 boostdroid.exe boostdroid.exe PID 2628 wrote to memory of 2292 2628 boostdroid.exe boostdroid.exe PID 2628 wrote to memory of 2292 2628 boostdroid.exe boostdroid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe"C:\Users\Admin\AppData\Local\Temp\4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe"C:\Users\Admin\AppData\Local\Temp\4e473457ea8eea869cc68754ddc1aca54d0343e912d16276a7ec7da023a16ffe.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\boostdroid.exe"C:\Windows\SysWOW64\boostdroid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\boostdroid.exe"C:\Windows\SysWOW64\boostdroid.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2292-153-0x0000000000000000-mapping.dmp
-
memory/2292-166-0x0000000001760000-0x0000000001776000-memory.dmpFilesize
88KB
-
memory/2292-163-0x0000000000740000-0x0000000000763000-memory.dmpFilesize
140KB
-
memory/2292-164-0x0000000001760000-0x0000000001776000-memory.dmpFilesize
88KB
-
memory/2292-165-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/2292-154-0x0000000001780000-0x0000000001796000-memory.dmpFilesize
88KB
-
memory/2292-158-0x0000000001780000-0x0000000001796000-memory.dmpFilesize
88KB
-
memory/2628-161-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/2628-152-0x0000000000860000-0x0000000000876000-memory.dmpFilesize
88KB
-
memory/2628-159-0x0000000000740000-0x0000000000763000-memory.dmpFilesize
140KB
-
memory/2628-160-0x0000000000840000-0x0000000000856000-memory.dmpFilesize
88KB
-
memory/2628-148-0x0000000000860000-0x0000000000876000-memory.dmpFilesize
88KB
-
memory/4128-144-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/4128-142-0x0000000000740000-0x0000000000763000-memory.dmpFilesize
140KB
-
memory/4128-143-0x0000000000E60000-0x0000000000E76000-memory.dmpFilesize
88KB
-
memory/4128-130-0x0000000000740000-0x0000000000763000-memory.dmpFilesize
140KB
-
memory/4128-135-0x0000000000E80000-0x0000000000E96000-memory.dmpFilesize
88KB
-
memory/4128-131-0x0000000000E80000-0x0000000000E96000-memory.dmpFilesize
88KB
-
memory/4704-145-0x0000000000740000-0x0000000000763000-memory.dmpFilesize
140KB
-
memory/4704-141-0x0000000000A00000-0x0000000000A16000-memory.dmpFilesize
88KB
-
memory/4704-162-0x00000000008D0000-0x00000000008E6000-memory.dmpFilesize
88KB
-
memory/4704-146-0x00000000008D0000-0x00000000008E6000-memory.dmpFilesize
88KB
-
memory/4704-147-0x0000000000B20000-0x0000000000DA1000-memory.dmpFilesize
2.5MB
-
memory/4704-137-0x0000000000A00000-0x0000000000A16000-memory.dmpFilesize
88KB
-
memory/4704-136-0x0000000000000000-mapping.dmp