0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4

General

Target

0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe
Size

620KB
MD5

01f9e3b9ba65dbc9d1592b907ae8313b
SHA1

c3d87495e52aff278ada34a8e9d03c13155ccd35
SHA256

0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4
SHA512

5b1f7c3ddfb7e0c2fe87c111a72e58e4de8db28142c100bbd5db15b104304302216f16cacb43ccc16a5e2d43e1a2289d22254e6965e3ddeb11b23295127fcc38
SSDEEP

6144:GPNDXW8jOD/gSwgQM6/lkw3RRHxNjfOB8xOE5S:wW77gSw7WwB

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Corp = "C:\\Users\\Admin\\AppData\\Roaming\\svchosts.exe"	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe

Executes dropped EXE 2 IoCs

pid	Process
4344	svchosts.exe
4984	svchosts.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5100-136-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/5100-138-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/5100-139-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/5100-140-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/5100-146-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4984-156-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corp = "C:\\Users\\Admin\\AppData\\Roaming\\svchosts.exe"	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Corp = "C:\\Users\\Admin\\AppData\\Roaming\\svchosts.exe"	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe
File opened for modification	\??\PhysicalDrive0	svchosts.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1200 set thread context of 5100	1200	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe	83
PID 4344 set thread context of 4984	4344	svchosts.exe	85

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1200	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe
4344	svchosts.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 5100	1200	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe	83
PID 1200 wrote to memory of 5100	1200	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe	83
PID 1200 wrote to memory of 5100	1200	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe	83
PID 1200 wrote to memory of 5100	1200	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe	83
PID 1200 wrote to memory of 5100	1200	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe	83
PID 1200 wrote to memory of 5100	1200	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe	83
PID 1200 wrote to memory of 5100	1200	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe	83
PID 1200 wrote to memory of 5100	1200	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe	83
PID 5100 wrote to memory of 4344	5100	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe	84
PID 5100 wrote to memory of 4344	5100	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe	84
PID 5100 wrote to memory of 4344	5100	0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe	84
PID 4344 wrote to memory of 4984	4344	svchosts.exe	85
PID 4344 wrote to memory of 4984	4344	svchosts.exe	85
PID 4344 wrote to memory of 4984	4344	svchosts.exe	85
PID 4344 wrote to memory of 4984	4344	svchosts.exe	85
PID 4344 wrote to memory of 4984	4344	svchosts.exe	85
PID 4344 wrote to memory of 4984	4344	svchosts.exe	85
PID 4344 wrote to memory of 4984	4344	svchosts.exe	85
PID 4344 wrote to memory of 4984	4344	svchosts.exe	85

C:\Users\Admin\AppData\Local\Temp\0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe
"C:\Users\Admin\AppData\Local\Temp\0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe
  "C:\Users\Admin\AppData\Local\Temp\0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Users\Admin\AppData\Roaming\svchosts.exe
    /NEWSHIT
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Users\Admin\AppData\Roaming\svchosts.exe
      /NEWSHIT
      4⤵
      Executes dropped EXE
      PID:4984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchosts.exe

Filesize
620KB

MD5
01f9e3b9ba65dbc9d1592b907ae8313b

SHA1
c3d87495e52aff278ada34a8e9d03c13155ccd35

SHA256
0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4

SHA512
5b1f7c3ddfb7e0c2fe87c111a72e58e4de8db28142c100bbd5db15b104304302216f16cacb43ccc16a5e2d43e1a2289d22254e6965e3ddeb11b23295127fcc38

Download Submit
C:\Users\Admin\AppData\Roaming\svchosts.exe

Filesize
620KB

MD5
01f9e3b9ba65dbc9d1592b907ae8313b

SHA1
c3d87495e52aff278ada34a8e9d03c13155ccd35

SHA256
0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4

SHA512
5b1f7c3ddfb7e0c2fe87c111a72e58e4de8db28142c100bbd5db15b104304302216f16cacb43ccc16a5e2d43e1a2289d22254e6965e3ddeb11b23295127fcc38

Download Submit
C:\Users\Admin\AppData\Roaming\svchosts.exe

Filesize
620KB

MD5
01f9e3b9ba65dbc9d1592b907ae8313b

SHA1
c3d87495e52aff278ada34a8e9d03c13155ccd35

SHA256
0b316a631fc8070439407abefcde6e9b25fd9519dc587e5b2bf599269a059ea4

SHA512
5b1f7c3ddfb7e0c2fe87c111a72e58e4de8db28142c100bbd5db15b104304302216f16cacb43ccc16a5e2d43e1a2289d22254e6965e3ddeb11b23295127fcc38

Download Submit
memory/1200-132-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1200-147-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4344-155-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4344-148-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4984-156-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5100-146-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5100-140-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5100-139-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5100-138-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5100-136-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads