9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272

General

Target

9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
Size

454KB
MD5

1c47243eaae673a0777df97c43974f10
SHA1

58787798b2f1b2d359da52875fb22b45a0c976ac
SHA256

9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272
SHA512

db2ed4451ea39480dd22ef6b6398914883667ddd33460b4b330ab470db2d1735ef07ddbf593155f33d15c71dcedcc381b55793061477267659a62d46affe6194
SSDEEP

12288:lhrCbb9ucMu5aCQ+8Wy5VtogPXFCzeuWgvayZBzoS:lhc9uBCQ+8Wyxy/vd

Score

8^/10

bootkit persistence spyware stealer upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1492-60-0x0000000000400000-0x000000000054A000-memory.dmp	upx
behavioral1/memory/1492-61-0x0000000000400000-0x000000000054A000-memory.dmp	upx
behavioral1/memory/1492-62-0x0000000000400000-0x000000000054A000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
584	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1688	1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe	27
PID 1492 wrote to memory of 1688	1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe	27
PID 1492 wrote to memory of 1688	1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe	27
PID 1492 wrote to memory of 1688	1492	9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe	27
PID 1688 wrote to memory of 1376	1688	cmd.exe	29
PID 1688 wrote to memory of 1376	1688	cmd.exe	29
PID 1688 wrote to memory of 1376	1688	cmd.exe	29
PID 1688 wrote to memory of 1376	1688	cmd.exe	29
PID 1376 wrote to memory of 284	1376	net.exe	30
PID 1376 wrote to memory of 284	1376	net.exe	30
PID 1376 wrote to memory of 284	1376	net.exe	30
PID 1376 wrote to memory of 284	1376	net.exe	30
PID 1688 wrote to memory of 584	1688	cmd.exe	31
PID 1688 wrote to memory of 584	1688	cmd.exe	31
PID 1688 wrote to memory of 584	1688	cmd.exe	31
PID 1688 wrote to memory of 584	1688	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
"C:\Users\Admin\AppData\Local\Temp\9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe.pkx\dis.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\net.exe
    net stop "PolicyAgent"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "PolicyAgent"
      4⤵
      PID:284
- - C:\Windows\SysWOW64\sc.exe
    sc config PolicyAgent start= disabled
    3⤵
    - Launches sc.exe
    PID:584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe.pkx\dis.bat

Filesize
63B

MD5
070f1025dc93f20d1b28896c8ab01ff3

SHA1
3a646f02dbf445ea75f331d1128e711ea2463d64

SHA256
e6374bfc2301536dc06ce5e26b299fad2c630cde8a47548cd31edd86deed38b3

SHA512
c5017b2ad1b76b55ad49c41ea06decf71b5ee00934c583d919c489e6d4da506174dd7be62b36af6c3b77c6ae0fd6825fe3fbe86e881ef47bc1749e2c86c6edef

Download Submit
memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-60-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1492-61-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1492-62-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing