f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd

General

Target

f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe
Size

942KB
MD5

6abbdb80f29a20074deffd1f29309590
SHA1

3533e66007ad76ef969da9c8db8e9b0de4577100
SHA256

f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd
SHA512

7220633349de4bdd4ae2e144f0495025c3581afeca2b4c7907dd8a3d9e203d621640d7b2a729d570abf9aaf3843c3c53978c858fc9477380cc25a76988e43200
SSDEEP

24576:orYb0aldVwHBBA5WXlo6sNWqdsFdZYviowhtjlON1tYY:P08dVMBBRloafYvid60Y

Score

8^/10

bootkit evasion persistence trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

lmi_instantchat.exe

pid process

2976 lmi_instantchat.exe
Loads dropped DLL 1 IoCs

Processes:

lmi_instantchat.exe

pid process

2976 lmi_instantchat.exe

pid	process
2976	lmi_instantchat.exe

pid	process
2976	lmi_instantchat.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

lmi_instantchat.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	lmi_instantchat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*LogMeInRescue_373200114 = "\"C:\\Windows\\LMI83BB.tmp\\lmi_instantchat.exe\" -runonce reboot"	lmi_instantchat.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

lmi_instantchat.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lmi_instantchat.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

lmi_instantchat.exe

description ioc process

File opened for modification \??\PhysicalDrive0 lmi_instantchat.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lmi_instantchat.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	lmi_instantchat.exe

Drops file in Windows directory 9 IoCs

Processes:

f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exelmi_instantchat.exe

description	ioc	process
File created	C:\Windows\LMI83BB.tmp\rescue.ico	f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe
File created	C:\Windows\LMI83BB.tmp\rahook.dll	f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe
File created	C:\Windows\LMI83BB.tmp\params.txt	f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe
File opened for modification	C:\Windows\LMI83BB.tmp\params.txt	f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe
File opened for modification	C:\Windows\LMI83BB.tmp\LMI_InstantChat_srv.exe	f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe
File opened for modification	C:\Windows\LMI83BB.tmp\rescue.log	lmi_instantchat.exe
File created	C:\Windows\LMI83BB.tmp\lmi_instantchat.exe	f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe
File created	C:\Windows\LMI83BB.tmp\ra64app.exe	f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe
File created	C:\Windows\LMI83BB.tmp\LMI_InstantChat_srv.exe	f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

lmi_instantchat.exe

pid process

2976 lmi_instantchat.exe
2976 lmi_instantchat.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

lmi_instantchat.exe

pid process

2976 lmi_instantchat.exe

pid	process
2976	lmi_instantchat.exe
2976	lmi_instantchat.exe

pid	process
2976	lmi_instantchat.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe

description	pid	process	target process
PID 1664 wrote to memory of 2976	1664	f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe	lmi_instantchat.exe
PID 1664 wrote to memory of 2976	1664	f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe	lmi_instantchat.exe
PID 1664 wrote to memory of 2976	1664	f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe	lmi_instantchat.exe

C:\Users\Admin\AppData\Local\Temp\f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe
"C:\Users\Admin\AppData\Local\Temp\f4fabd43871d0f069c80d27d735a486eecb9893a3ad4541a3b7924c896f7ccdd.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\LMI83BB.tmp\lmi_instantchat.exe
"C:\Windows\LMI83BB.tmp\lmi_instantchat.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2976

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\LMI83BB.tmp\lmi_instantchat.exe
Filesize
1.7MB

MD5
c52eb58a5ea072346702d0ea5a364737

SHA1
fc424772c5a1acea8a60c815a3f7966052cdd698

SHA256
1c150a386f9d0942461b9cc700814964d5dfe1e74f9e9df6dcfa00a1861b3c00

SHA512
f12ea8b561c331806407d29b940400441eab920fa9e55b96c949a32599bfeb3fe2eca6ccb2f5a29783432f1694bfda0550b294dc39cad1cb432434b1b24b9682

Download Submit
C:\Windows\LMI83BB.tmp\lmi_instantchat.exe
Filesize
1.7MB

MD5
c52eb58a5ea072346702d0ea5a364737

SHA1
fc424772c5a1acea8a60c815a3f7966052cdd698

SHA256
1c150a386f9d0942461b9cc700814964d5dfe1e74f9e9df6dcfa00a1861b3c00

SHA512
f12ea8b561c331806407d29b940400441eab920fa9e55b96c949a32599bfeb3fe2eca6ccb2f5a29783432f1694bfda0550b294dc39cad1cb432434b1b24b9682

Download Submit
C:\Windows\LMI83BB.tmp\params.txt
Filesize
561B

MD5
339613224f1c891e08650c6745ab52c2

SHA1
fc2d017025817c8766645e9bbdf663dd1736a1a7

SHA256
2b1c23e39a28a69e511564c24f4b89a4d6fc34b9e1d255621176d54c249383f3

SHA512
4890ad4fd038d74e6b1c868e1fbe1a78ce6990252f82f3d4907bd4baefc93fedb14956164c4b632694fd0689d2184c14a0ccf1d09ce8372d49255a36619ff1cb

Download Submit
C:\Windows\LMI83BB.tmp\rahook.dll
Filesize
173KB

MD5
bf790824092803a6384371b3996d0143

SHA1
81a870b23b999817516a5a47f01b0bf1f862c223

SHA256
585234c1ed97e97bf46a11967e0d82c0118423835627ffdddf7343ebb92ca120

SHA512
46f6b2c3e5b930d8358933fcb9f5a24b5a666fd0567501563143763da9e14da7317da19bc26ae3d35716fd17807686519dc78921b7ff79fdbf60746398457d9e

Download Submit
C:\Windows\LMI83BB.tmp\rahook.dll
Filesize
173KB

MD5
bf790824092803a6384371b3996d0143

SHA1
81a870b23b999817516a5a47f01b0bf1f862c223

SHA256
585234c1ed97e97bf46a11967e0d82c0118423835627ffdddf7343ebb92ca120

SHA512
46f6b2c3e5b930d8358933fcb9f5a24b5a666fd0567501563143763da9e14da7317da19bc26ae3d35716fd17807686519dc78921b7ff79fdbf60746398457d9e

Download Submit
C:\Windows\LMI83BB.tmp\rescue.ico
Filesize
48KB

MD5
51fa8f4746f1a481c5ea25931e99ed77

SHA1
76a78677e527a0564533d90ed16fe5d7da8102e2

SHA256
ad3ec59a6f04578dc4dd9b85dbb2552019fb509201524c6cb8d06fea73da62d7

SHA512
c7a3a40ec447800297138c8ae35739c080388654f1afeb3a2c55080477615efbce94f05a3683f3f5528e9eb8e0ab5477be3f396a7b32e21cfd73b39e68197b29

Download Submit
memory/2976-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads