00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1

General

Target

00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1.exe
Size

844KB
MD5

83f486d1953416ccf18c378009efc528
SHA1

a48f3aebf1e26c12b498e6d66ca599d10c763b35
SHA256

00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1
SHA512

641962a04feb1dc9e1baf4d4b06ea5362fc4836f3b87cf013d5ce53e2729b682b5b52c11af106e1ce870e1a1874ebdaabbb96a6c0137ae563c00ba72368c1225
SSDEEP

12288:/U8+JhYTdmEfwaygnXvkxWUWBD+Ss1engI7ueSLygbZ3/ictSW9IapSU2B:/GJOEAwaygnXv2wa3enT7m/GNi2B

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1772	isecurity.exe

Loads dropped DLL 3 IoCs

pid	Process
1348	00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1.exe
1348	00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1.exe
1348	00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	isecurity.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security = "C:\\ProgramData\\isecurity.exe"	isecurity.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	isecurity.exe
File opened (read-only)	\??\N:	isecurity.exe
File opened (read-only)	\??\R:	isecurity.exe
File opened (read-only)	\??\U:	isecurity.exe
File opened (read-only)	\??\W:	isecurity.exe
File opened (read-only)	\??\F:	isecurity.exe
File opened (read-only)	\??\L:	isecurity.exe
File opened (read-only)	\??\P:	isecurity.exe
File opened (read-only)	\??\Q:	isecurity.exe
File opened (read-only)	\??\S:	isecurity.exe
File opened (read-only)	\??\T:	isecurity.exe
File opened (read-only)	\??\V:	isecurity.exe
File opened (read-only)	\??\Y:	isecurity.exe
File opened (read-only)	\??\Z:	isecurity.exe
File opened (read-only)	\??\G:	isecurity.exe
File opened (read-only)	\??\H:	isecurity.exe
File opened (read-only)	\??\K:	isecurity.exe
File opened (read-only)	\??\M:	isecurity.exe
File opened (read-only)	\??\E:	isecurity.exe
File opened (read-only)	\??\J:	isecurity.exe
File opened (read-only)	\??\O:	isecurity.exe
File opened (read-only)	\??\X:	isecurity.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	isecurity.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1348	00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1348	00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe
1772	isecurity.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1772	isecurity.exe
1772	isecurity.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1772	1348	00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1.exe	27
PID 1348 wrote to memory of 1772	1348	00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1.exe	27
PID 1348 wrote to memory of 1772	1348	00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1.exe	27
PID 1348 wrote to memory of 1772	1348	00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1.exe	27

C:\Users\Admin\AppData\Local\Temp\00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1.exe
"C:\Users\Admin\AppData\Local\Temp\00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1348
- C:\ProgramData\isecurity.exe
  C:\ProgramData\isecurity.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\isecurity.exe

Filesize
835KB

MD5
b3b1fe7a9edee105d6869e67a3d19247

SHA1
e0fa3771b9786db99909d8999ca0be0d59020b27

SHA256
a20bae3491f5b551e89e9b4361f42da028f38d4574a7416208cbcb56041a85e0

SHA512
b6fa2397546b8a9d534c576a85e8d33c4c5eb2f80d1c471ea75a183b96ba124b94c07a756ff416c2dc13f48acf20a96b81b4e0ae14efbfb041577ce51514ac19

Download Submit
\ProgramData\isecurity.exe

Filesize
835KB

MD5
b3b1fe7a9edee105d6869e67a3d19247

SHA1
e0fa3771b9786db99909d8999ca0be0d59020b27

SHA256
a20bae3491f5b551e89e9b4361f42da028f38d4574a7416208cbcb56041a85e0

SHA512
b6fa2397546b8a9d534c576a85e8d33c4c5eb2f80d1c471ea75a183b96ba124b94c07a756ff416c2dc13f48acf20a96b81b4e0ae14efbfb041577ce51514ac19

Download Submit
\ProgramData\isecurity.exe

Filesize
835KB

MD5
b3b1fe7a9edee105d6869e67a3d19247

SHA1
e0fa3771b9786db99909d8999ca0be0d59020b27

SHA256
a20bae3491f5b551e89e9b4361f42da028f38d4574a7416208cbcb56041a85e0

SHA512
b6fa2397546b8a9d534c576a85e8d33c4c5eb2f80d1c471ea75a183b96ba124b94c07a756ff416c2dc13f48acf20a96b81b4e0ae14efbfb041577ce51514ac19

Download Submit
\ProgramData\isecurity.exe

Filesize
835KB

MD5
b3b1fe7a9edee105d6869e67a3d19247

SHA1
e0fa3771b9786db99909d8999ca0be0d59020b27

SHA256
a20bae3491f5b551e89e9b4361f42da028f38d4574a7416208cbcb56041a85e0

SHA512
b6fa2397546b8a9d534c576a85e8d33c4c5eb2f80d1c471ea75a183b96ba124b94c07a756ff416c2dc13f48acf20a96b81b4e0ae14efbfb041577ce51514ac19

Download Submit
memory/1348-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1348-55-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1772-62-0x0000000000400000-0x0000000000A3A000-memory.dmp

Filesize
6.2MB

Download
memory/1772-64-0x0000000000400000-0x0000000000A3A000-memory.dmp

Filesize
6.2MB

Download
memory/1772-65-0x0000000000400000-0x0000000000A3A000-memory.dmp

Filesize
6.2MB

Download

Analysis

Sharing