Analysis
-
max time kernel
33s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 19:44
Static task
static1
Behavioral task
behavioral1
Sample
ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe
Resource
win10v2004-20220901-en
General
-
Target
ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe
-
Size
593KB
-
MD5
a01ff27c6d183a9b58e6c7394db22250
-
SHA1
78a563c62fbf2d2b065c82ba741ddc9465f83760
-
SHA256
ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a
-
SHA512
f0541e5d656298f703c1a3cc3bee5e745eb127123ddb7280e3b64936c1803c4d311d0d1592705359871319e5364bb318871b47e3b2bc00a2187cc0fc72a84359
-
SSDEEP
12288:VuBSP/amCdBJSpc/aaT9/gur79Yq63kfydqAKTE1qH:sA6dBwy/aI/gK79YH0FAgxH
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4828 BqjnC0gFVHRul8.exe 2576 win.exe 1112 wio.exe 5020 wiq.exe -
resource yara_rule behavioral2/memory/2736-158-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/2736-162-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/2736-160-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/2736-166-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 3428 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Azopuzifowasilar = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Fokbdpcf.dll\",Startup" rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\physicaldrive0 win.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5020 set thread context of 2736 5020 wiq.exe 88 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 4828 BqjnC0gFVHRul8.exe 4828 BqjnC0gFVHRul8.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2576 win.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4828 BqjnC0gFVHRul8.exe 5020 wiq.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 384 wrote to memory of 4828 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 81 PID 384 wrote to memory of 4828 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 81 PID 384 wrote to memory of 4828 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 81 PID 384 wrote to memory of 2576 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 82 PID 384 wrote to memory of 2576 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 82 PID 384 wrote to memory of 2576 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 82 PID 384 wrote to memory of 1112 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 83 PID 384 wrote to memory of 1112 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 83 PID 384 wrote to memory of 1112 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 83 PID 384 wrote to memory of 5020 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 84 PID 384 wrote to memory of 5020 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 84 PID 384 wrote to memory of 5020 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 84 PID 384 wrote to memory of 4460 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 85 PID 384 wrote to memory of 4460 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 85 PID 384 wrote to memory of 4460 384 ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe 85 PID 1112 wrote to memory of 3428 1112 wio.exe 87 PID 1112 wrote to memory of 3428 1112 wio.exe 87 PID 1112 wrote to memory of 3428 1112 wio.exe 87 PID 5020 wrote to memory of 2736 5020 wiq.exe 88 PID 5020 wrote to memory of 2736 5020 wiq.exe 88 PID 5020 wrote to memory of 2736 5020 wiq.exe 88 PID 5020 wrote to memory of 2736 5020 wiq.exe 88 PID 5020 wrote to memory of 2736 5020 wiq.exe 88 PID 5020 wrote to memory of 2736 5020 wiq.exe 88 PID 5020 wrote to memory of 2736 5020 wiq.exe 88 PID 5020 wrote to memory of 2736 5020 wiq.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe"C:\Users\Admin\AppData\Local\Temp\ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\BqjnC0gFVHRul8.exeBqjnC0gFVHRul8.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4828
-
-
C:\Users\Admin\win.exewin.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
-
C:\Users\Admin\wio.exewio.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Fokbdpcf.dll",Startup3⤵
- Loads dropped DLL
- Adds Run key to start application
PID:3428
-
-
-
C:\Users\Admin\wiq.exewiq.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c del ac658726e7d186f5732d1496d473cee9a4119675da4a4f95dce943350459da0a.exe2⤵PID:4460
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD519f8a2d4e8270baf8bd5a6086f565e70
SHA1b5a05abe09066906b569f0fadefb00fb567ef547
SHA2562f677a22315a327d82514449be56d53cd85a8dd3eef75317231647faac6caf50
SHA5128a5686b22a993f8c38420f9c163e6321eab7a089858da4852160684ccc260d82f21e933365e0f413418849f9af26786d805d0dd6295546b52ae9ab5fcf88ed63
-
Filesize
103KB
MD519f8a2d4e8270baf8bd5a6086f565e70
SHA1b5a05abe09066906b569f0fadefb00fb567ef547
SHA2562f677a22315a327d82514449be56d53cd85a8dd3eef75317231647faac6caf50
SHA5128a5686b22a993f8c38420f9c163e6321eab7a089858da4852160684ccc260d82f21e933365e0f413418849f9af26786d805d0dd6295546b52ae9ab5fcf88ed63
-
Filesize
148KB
MD5fc8e30e732d9e1483b7d29ea39ad9c15
SHA104215f820a214d11e1dd9a832ac264605cf98604
SHA256c3bb55f793445fe9ca4dbdd55c7dd1d5ec90c807d3270833b3f9678a9a956585
SHA512d56cb22fde3d54cc4d5008857e573e4b8182b4d690c9a9ca9978aca5ed0051001c919588918ac17dd7c3d41c90acca9411d42cf33c10accd12d3d313fb60afd6
-
Filesize
148KB
MD5fc8e30e732d9e1483b7d29ea39ad9c15
SHA104215f820a214d11e1dd9a832ac264605cf98604
SHA256c3bb55f793445fe9ca4dbdd55c7dd1d5ec90c807d3270833b3f9678a9a956585
SHA512d56cb22fde3d54cc4d5008857e573e4b8182b4d690c9a9ca9978aca5ed0051001c919588918ac17dd7c3d41c90acca9411d42cf33c10accd12d3d313fb60afd6
-
Filesize
172KB
MD516dfe37b77854e727eabedd05239ebee
SHA19218bb944834fb46eb2f04858ada0dacdf821d77
SHA2568ee33551b06628414ed9003fd0c35ab5abbedf6f85e50c9bfdb99fc72172d267
SHA51256c765b030817f0903dd9ce50aefb3511e30706891f7d9accd7f95c465d1890fdda3ab59238919b59951fe1c361699f80675b6fab9c9df26dd4f22d97b0ca903
-
Filesize
172KB
MD516dfe37b77854e727eabedd05239ebee
SHA19218bb944834fb46eb2f04858ada0dacdf821d77
SHA2568ee33551b06628414ed9003fd0c35ab5abbedf6f85e50c9bfdb99fc72172d267
SHA51256c765b030817f0903dd9ce50aefb3511e30706891f7d9accd7f95c465d1890fdda3ab59238919b59951fe1c361699f80675b6fab9c9df26dd4f22d97b0ca903
-
Filesize
103KB
MD5f7756f6980dc23ef661085d6cd999831
SHA1cd77f7a9bc8c058023779a531e2deac8c3241638
SHA25653122fb8bd9b1a304af221e3172c1770f18d20e71f275b98bcfe10cc81ec3740
SHA512b1e51945dea731c962140b9755c2d6b549feb3fb0d9793a0c67fe6a99498dde1a4744931ca80053f723eec221975e26220e7c357188bd0f11f5966bf2cc618df
-
Filesize
103KB
MD5f7756f6980dc23ef661085d6cd999831
SHA1cd77f7a9bc8c058023779a531e2deac8c3241638
SHA25653122fb8bd9b1a304af221e3172c1770f18d20e71f275b98bcfe10cc81ec3740
SHA512b1e51945dea731c962140b9755c2d6b549feb3fb0d9793a0c67fe6a99498dde1a4744931ca80053f723eec221975e26220e7c357188bd0f11f5966bf2cc618df
-
Filesize
52KB
MD565a849404ffe62e0d2f56d7993f00920
SHA16401a9e92690172958fbf0ee122990479628e92f
SHA256afe7c75a0e8d28d5f068cf3605f9aa10016d37348eab013b6dc487e943110c50
SHA51299af61b924d550ff3d8c52db86991cc40ebd94510982dc69ce99bb975ad8de32c07ea9c7eb28d05e55117b15ab3b57d3d2bfe25c744c8918d63d96ef974d5d38
-
Filesize
52KB
MD565a849404ffe62e0d2f56d7993f00920
SHA16401a9e92690172958fbf0ee122990479628e92f
SHA256afe7c75a0e8d28d5f068cf3605f9aa10016d37348eab013b6dc487e943110c50
SHA51299af61b924d550ff3d8c52db86991cc40ebd94510982dc69ce99bb975ad8de32c07ea9c7eb28d05e55117b15ab3b57d3d2bfe25c744c8918d63d96ef974d5d38