Analysis

  • max time kernel
    33s
  • max time network
    73s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 19:44

General

  • Target

    ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe

  • Size

    593KB

  • MD5

    a01ff27c6d183a9b58e6c7394db22250

  • SHA1

    78a563c62fbf2d2b065c82ba741ddc9465f83760

  • SHA256

    ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a

  • SHA512

    f0541e5d656298f703c1a3cc3bee5e745eb127123ddb7280e3b64936c1803c4d311d0d1592705359871319e5364bb318871b47e3b2bc00a2187cc0fc72a84359

  • SSDEEP

    12288:VuBSP/amCdBJSpc/aaT9/gur79Yq63kfydqAKTE1qH:sA6dBwy/aI/gK79YH0FAgxH

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe
    "C:\Users\Admin\AppData\Local\Temp\ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Users\Admin\BqjnC0gFVHRul8.exe
      BqjnC0gFVHRul8.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4828
    • C:\Users\Admin\win.exe
      win.exe
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of AdjustPrivilegeToken
      PID:2576
    • C:\Users\Admin\wio.exe
      wio.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Fokbdpcf.dll",Startup
        3⤵
        • Loads dropped DLL
        • Adds Run key to start application
        PID:3428
    • C:\Users\Admin\wiq.exe
      wiq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5020
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\system32\svchost.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2736
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe
      2⤵
        PID:4460

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Fokbdpcf.dll

      Filesize

      103KB

      MD5

      19f8a2d4e8270baf8bd5a6086f565e70

      SHA1

      b5a05abe09066906b569f0fadefb00fb567ef547

      SHA256

      2f677a22315a327d82514449be56d53cd85a8dd3eef75317231647faac6caf50

      SHA512

      8a5686b22a993f8c38420f9c163e6321eab7a089858da4852160684ccc260d82f21e933365e0f413418849f9af26786d805d0dd6295546b52ae9ab5fcf88ed63

    • C:\Users\Admin\AppData\Local\Fokbdpcf.dll

      Filesize

      103KB

      MD5

      19f8a2d4e8270baf8bd5a6086f565e70

      SHA1

      b5a05abe09066906b569f0fadefb00fb567ef547

      SHA256

      2f677a22315a327d82514449be56d53cd85a8dd3eef75317231647faac6caf50

      SHA512

      8a5686b22a993f8c38420f9c163e6321eab7a089858da4852160684ccc260d82f21e933365e0f413418849f9af26786d805d0dd6295546b52ae9ab5fcf88ed63

    • C:\Users\Admin\BqjnC0gFVHRul8.exe

      Filesize

      148KB

      MD5

      fc8e30e732d9e1483b7d29ea39ad9c15

      SHA1

      04215f820a214d11e1dd9a832ac264605cf98604

      SHA256

      c3bb55f793445fe9ca4dbdd55c7dd1d5ec90c807d3270833b3f9678a9a956585

      SHA512

      d56cb22fde3d54cc4d5008857e573e4b8182b4d690c9a9ca9978aca5ed0051001c919588918ac17dd7c3d41c90acca9411d42cf33c10accd12d3d313fb60afd6

    • C:\Users\Admin\BqjnC0gFVHRul8.exe

      Filesize

      148KB

      MD5

      fc8e30e732d9e1483b7d29ea39ad9c15

      SHA1

      04215f820a214d11e1dd9a832ac264605cf98604

      SHA256

      c3bb55f793445fe9ca4dbdd55c7dd1d5ec90c807d3270833b3f9678a9a956585

      SHA512

      d56cb22fde3d54cc4d5008857e573e4b8182b4d690c9a9ca9978aca5ed0051001c919588918ac17dd7c3d41c90acca9411d42cf33c10accd12d3d313fb60afd6

    • C:\Users\Admin\win.exe

      Filesize

      172KB

      MD5

      16dfe37b77854e727eabedd05239ebee

      SHA1

      9218bb944834fb46eb2f04858ada0dacdf821d77

      SHA256

      8ee33551b06628414ed9003fd0c35ab5abbedf6f85e50c9bfdb99fc72172d267

      SHA512

      56c765b030817f0903dd9ce50aefb3511e30706891f7d9accd7f95c465d1890fdda3ab59238919b59951fe1c361699f80675b6fab9c9df26dd4f22d97b0ca903

    • C:\Users\Admin\win.exe

      Filesize

      172KB

      MD5

      16dfe37b77854e727eabedd05239ebee

      SHA1

      9218bb944834fb46eb2f04858ada0dacdf821d77

      SHA256

      8ee33551b06628414ed9003fd0c35ab5abbedf6f85e50c9bfdb99fc72172d267

      SHA512

      56c765b030817f0903dd9ce50aefb3511e30706891f7d9accd7f95c465d1890fdda3ab59238919b59951fe1c361699f80675b6fab9c9df26dd4f22d97b0ca903

    • C:\Users\Admin\wio.exe

      Filesize

      103KB

      MD5

      f7756f6980dc23ef661085d6cd999831

      SHA1

      cd77f7a9bc8c058023779a531e2deac8c3241638

      SHA256

      53122fb8bd9b1a304af221e3172c1770f18d20e71f275b98bcfe10cc81ec3740

      SHA512

      b1e51945dea731c962140b9755c2d6b549feb3fb0d9793a0c67fe6a99498dde1a4744931ca80053f723eec221975e26220e7c357188bd0f11f5966bf2cc618df

    • C:\Users\Admin\wio.exe

      Filesize

      103KB

      MD5

      f7756f6980dc23ef661085d6cd999831

      SHA1

      cd77f7a9bc8c058023779a531e2deac8c3241638

      SHA256

      53122fb8bd9b1a304af221e3172c1770f18d20e71f275b98bcfe10cc81ec3740

      SHA512

      b1e51945dea731c962140b9755c2d6b549feb3fb0d9793a0c67fe6a99498dde1a4744931ca80053f723eec221975e26220e7c357188bd0f11f5966bf2cc618df

    • C:\Users\Admin\wiq.exe

      Filesize

      52KB

      MD5

      65a849404ffe62e0d2f56d7993f00920

      SHA1

      6401a9e92690172958fbf0ee122990479628e92f

      SHA256

      afe7c75a0e8d28d5f068cf3605f9aa10016d37348eab013b6dc487e943110c50

      SHA512

      99af61b924d550ff3d8c52db86991cc40ebd94510982dc69ce99bb975ad8de32c07ea9c7eb28d05e55117b15ab3b57d3d2bfe25c744c8918d63d96ef974d5d38

    • C:\Users\Admin\wiq.exe

      Filesize

      52KB

      MD5

      65a849404ffe62e0d2f56d7993f00920

      SHA1

      6401a9e92690172958fbf0ee122990479628e92f

      SHA256

      afe7c75a0e8d28d5f068cf3605f9aa10016d37348eab013b6dc487e943110c50

      SHA512

      99af61b924d550ff3d8c52db86991cc40ebd94510982dc69ce99bb975ad8de32c07ea9c7eb28d05e55117b15ab3b57d3d2bfe25c744c8918d63d96ef974d5d38

    • memory/1112-152-0x00000000020D1000-0x00000000020DF000-memory.dmp

      Filesize

      56KB

    • memory/1112-144-0x0000000010000000-0x000000001001D000-memory.dmp

      Filesize

      116KB

    • memory/2576-151-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/2576-161-0x0000000002090000-0x00000000020E6000-memory.dmp

      Filesize

      344KB

    • memory/2576-165-0x0000000002090000-0x00000000020E6000-memory.dmp

      Filesize

      344KB

    • memory/2576-164-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/2576-154-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/2736-162-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2736-158-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2736-160-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2736-166-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/3428-156-0x0000000010000000-0x000000001001D000-memory.dmp

      Filesize

      116KB

    • memory/3428-163-0x0000000000CA1000-0x0000000000CAF000-memory.dmp

      Filesize

      56KB