eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b

General

Target

eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe
Size

376KB
MD5

7afde63c27b3d782dbcc5da91e9bf720
SHA1

03130c6c9905f0203610b4bafd596fac15f62a2c
SHA256

eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b
SHA512

81e295b890de7962d24bdf4eb66aa4327e995993d544c4dbafa5d51da0f1dea22846ae32ae42483c355dfa98b923a8780f46ef4344b2e4c5a843c1362b675b65
SSDEEP

6144:cQY+7m4CFwuQQQQQQQQQQQQwvQ5EQQQQQQQQQQQQQQQQQQQ1O9WBEHaQQQQQQQQR:cl+7+FF5Nm+

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1208 set thread context of 4796	1208	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	87
PID 4796 set thread context of 4548	4796	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	88

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4548	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe
4548	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe
4548	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1208	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe
4796	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 4796	1208	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	87
PID 1208 wrote to memory of 4796	1208	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	87
PID 1208 wrote to memory of 4796	1208	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	87
PID 1208 wrote to memory of 4796	1208	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	87
PID 1208 wrote to memory of 4796	1208	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	87
PID 1208 wrote to memory of 4796	1208	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	87
PID 1208 wrote to memory of 4796	1208	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	87
PID 1208 wrote to memory of 4796	1208	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	87
PID 4796 wrote to memory of 4548	4796	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	88
PID 4796 wrote to memory of 4548	4796	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	88
PID 4796 wrote to memory of 4548	4796	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	88
PID 4796 wrote to memory of 4548	4796	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	88
PID 4796 wrote to memory of 4548	4796	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	88
PID 4796 wrote to memory of 4548	4796	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	88
PID 4796 wrote to memory of 4548	4796	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	88
PID 4796 wrote to memory of 4548	4796	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	88
PID 4796 wrote to memory of 4548	4796	eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe	88

C:\Users\Admin\AppData\Local\Temp\eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe
"C:\Users\Admin\AppData\Local\Temp\eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe
  "C:\Users\Admin\AppData\Local\Temp\eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Users\Admin\AppData\Local\Temp\eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe
    "C:\Users\Admin\AppData\Local\Temp\eb7ecf266c26118af342dbb21c1aff74156dc82029f99a365358061fe6d2a30b.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-134-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1208-138-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4548-141-0x0000000000000000-mapping.dmp

Download
memory/4548-142-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4548-145-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4548-147-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4548-148-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4796-135-0x0000000000000000-mapping.dmp

Download
memory/4796-136-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4796-144-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4796-146-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing