Analysis
-
max time kernel
75s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2022 08:44
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.BootkitX-gen.24031.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.Win32.BootkitX-gen.24031.exe
-
Size
972KB
-
MD5
3e336e588f8433c914b415a282d14b0b
-
SHA1
a5b36cf34d9ab4aca8b07a723848dd1dfcc755a4
-
SHA256
a88e5d5fb17e50a25cf6dfe2512fc45cc3f712dccccee2d08ee7d1dac7086e5e
-
SHA512
542aed70db8435e595b4552cf8c8abb97bfc02ce0702c28a6758a5dd184cd6418bd86f70b4055be2392b6dce12e2629d98a380d24dfcf2e9978b7bd70ae71e0f
-
SSDEEP
24576:1HneAr5UNl6hdN/qq0Ztypw9bN+Oz2jrl:1HTiPkJPTOz2t
Malware Config
Extracted
formbook
4.1
ba17
bearwant.com
sdsguanfang.com
steamcommunityvia.top
sugarplumtreasures.com
koronislakefishing.com
jmae.xyz
xhxnqemkiqe.xyz
playzcrew.com
zatwsbq.com
lankofix.com
sh-zhepeng.com
mibodamisxv.online
butterflyjewelry.store
finestrecitalto-spottoday.info
globomateria.com
royalmdarts.com
d4af10836709.com
shepwill.com
67aldrich.info
trustedmakers.club
burdiezholdings.com
facialcoach.com
hunterous.com
carei.xyz
positivityintheworkplace.com
top1productjapan.online
camperrentnovara.com
nostalgiaz.xyz
prepperandsalt.com
platinum-swallow-nest.com
jmdadoag.com
cornerstonesolarconsulting.com
carmelhasit.com
hospitalaurelia.com
epolystars.com
best5psychicreadingsites.com
cbradleyowens.com
cmshelps.com
leclefsdor.com
male-muscle-slave.cloud
eselinchen.com
statesunitedaction.net
goweet.com
hififurniturehouse.info
alphacapitaltrust.online
hotsellmed.com
sunxueling.com
firstclass-poolservice.com
tuveranopelayo.com
wayangslot.net
joseauto.net
consinko.com
pacificoffshorecharters.com
steemboard.xyz
poollife.info
miraihenokoibumi.net
mfh-sa.com
seontra.xyz
openfaders.com
guardianz.online
purse.gold
affaire-chaba.com
rosency.xyz
somethingform.site
digitalpursuitsonline.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4856-141-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.Win32.BootkitX-gen.24031.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Win32.BootkitX-gen.24031.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Win32.BootkitX-gen.24031.exedescription pid process target process PID 4664 set thread context of 4856 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe SecuriteInfo.com.Win32.BootkitX-gen.24031.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SecuriteInfo.com.Win32.BootkitX-gen.24031.exeSecuriteInfo.com.Win32.BootkitX-gen.24031.exepid process 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe 4856 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe 4856 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Win32.BootkitX-gen.24031.exedescription pid process Token: SeDebugPrivilege 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SecuriteInfo.com.Win32.BootkitX-gen.24031.exedescription pid process target process PID 4664 wrote to memory of 4012 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe schtasks.exe PID 4664 wrote to memory of 4012 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe schtasks.exe PID 4664 wrote to memory of 4012 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe schtasks.exe PID 4664 wrote to memory of 1176 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe SecuriteInfo.com.Win32.BootkitX-gen.24031.exe PID 4664 wrote to memory of 1176 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe SecuriteInfo.com.Win32.BootkitX-gen.24031.exe PID 4664 wrote to memory of 1176 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe SecuriteInfo.com.Win32.BootkitX-gen.24031.exe PID 4664 wrote to memory of 4856 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe SecuriteInfo.com.Win32.BootkitX-gen.24031.exe PID 4664 wrote to memory of 4856 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe SecuriteInfo.com.Win32.BootkitX-gen.24031.exe PID 4664 wrote to memory of 4856 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe SecuriteInfo.com.Win32.BootkitX-gen.24031.exe PID 4664 wrote to memory of 4856 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe SecuriteInfo.com.Win32.BootkitX-gen.24031.exe PID 4664 wrote to memory of 4856 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe SecuriteInfo.com.Win32.BootkitX-gen.24031.exe PID 4664 wrote to memory of 4856 4664 SecuriteInfo.com.Win32.BootkitX-gen.24031.exe SecuriteInfo.com.Win32.BootkitX-gen.24031.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.BootkitX-gen.24031.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.BootkitX-gen.24031.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KcmLjIjULbXH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF3EA.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.BootkitX-gen.24031.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.BootkitX-gen.24031.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF3EA.tmpFilesize
1KB
MD5f78c71086be3de55620a3f9cc5e3ed13
SHA14d135f133854db153976ef59c00818ba8e3dd9a7
SHA2569a7c9eadafad8f6ac0d8e434cedfc9b8525b25eb9cae2cccecbecd8b9d812aaf
SHA512a5202e7dd63f645bf50b32a7455a1a2c20e10e55aa9ea28ac9be8bfb2f07577c8ac96c23d864a088a39c5b13b1e7fddd4500031e387c46ab8bff07e833b88b23
-
memory/1176-139-0x0000000000000000-mapping.dmp
-
memory/4012-137-0x0000000000000000-mapping.dmp
-
memory/4664-132-0x0000000000680000-0x000000000077A000-memory.dmpFilesize
1000KB
-
memory/4664-133-0x0000000005700000-0x0000000005CA4000-memory.dmpFilesize
5.6MB
-
memory/4664-134-0x0000000005150000-0x00000000051E2000-memory.dmpFilesize
584KB
-
memory/4664-135-0x00000000051F0000-0x000000000528C000-memory.dmpFilesize
624KB
-
memory/4664-136-0x0000000005110000-0x000000000511A000-memory.dmpFilesize
40KB
-
memory/4856-140-0x0000000000000000-mapping.dmp
-
memory/4856-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4856-142-0x00000000010A0000-0x00000000013EA000-memory.dmpFilesize
3.3MB