9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15

General

Target

9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
Size

188KB
MD5

6f9536b102360206740d2f0feb3ee1ab
SHA1

6dec0adb46d54e6f7a6c1bce158c9235f2188028
SHA256

9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15
SHA512

8792cb3b664089084d8a0a47d3905334bdbbdbf591dee38a824601273c18a0c4c3b162a4ffd0ae014719291e0a7b84b60c08b0d069da87ccb1a849a502150849
SSDEEP

3072:DkfYM5ASFNYsY5uXHs9xmcqAQaLioyH/Tb9s33pn:QdASFNvYA3obLPyH+

Score

6^/10

bootkit persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\""	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\""	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 536 set thread context of 1788	536	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	28
PID 1788 set thread context of 976	1788	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
976	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
976	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
976	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
536	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
1788	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1788	536	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	28
PID 536 wrote to memory of 1788	536	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	28
PID 536 wrote to memory of 1788	536	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	28
PID 536 wrote to memory of 1788	536	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	28
PID 536 wrote to memory of 1788	536	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	28
PID 536 wrote to memory of 1788	536	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	28
PID 536 wrote to memory of 1788	536	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	28
PID 536 wrote to memory of 1788	536	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	28
PID 536 wrote to memory of 1788	536	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	28
PID 1788 wrote to memory of 976	1788	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	29
PID 1788 wrote to memory of 976	1788	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	29
PID 1788 wrote to memory of 976	1788	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	29
PID 1788 wrote to memory of 976	1788	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	29
PID 1788 wrote to memory of 976	1788	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	29
PID 1788 wrote to memory of 976	1788	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	29
PID 1788 wrote to memory of 976	1788	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	29
PID 1788 wrote to memory of 976	1788	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	29
PID 1788 wrote to memory of 976	1788	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	29
PID 1788 wrote to memory of 976	1788	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	29
PID 976 wrote to memory of 1276	976	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1276
- C:\Users\Admin\AppData\Local\Temp\9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
  "C:\Users\Admin\AppData\Local\Temp\9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Users\Admin\AppData\Local\Temp\9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
    "C:\Users\Admin\AppData\Local\Temp\9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
      "C:\Users\Admin\AppData\Local\Temp\9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe"
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: RenamesItself
      Suspicious use of WriteProcessMemory
      PID:976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/536-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/976-79-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/976-70-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/976-87-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/976-86-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/976-80-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/976-74-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/976-72-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/976-75-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/976-76-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/976-69-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1788-60-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1788-58-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1788-57-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1788-85-0x00000000004A0000-0x00000000004CF000-memory.dmp

Filesize
188KB

Download
memory/1788-84-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1788-63-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing