d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db.exe
Size

828KB
MD5

a2892a4d6b36f60635fcd92f67fba1d0
SHA1

c5761dda72bcefe794ede94b3a1cd27b6ce28714
SHA256

d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db
SHA512

5a709837c331d0933ddfdcd16d2551d315fb420f0dacc7762f8f3e62e1e807e9858505ce9a7ccf6c7881ec1fe52fee0d90a15477d59c08a2f5ba823335f4581a
SSDEEP

12288:cpIrZj+N1B1b4LoEb+XsN/B58hEy0xe8em:cpIrc1+oESXi/n82y0d

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1972	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1880	d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db.exe
1880	d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\svchost.exe	d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe
1972	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1880	d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db.exe
1972	svchost.exe
1972	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1972	1880	d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db.exe	27
PID 1880 wrote to memory of 1972	1880	d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db.exe	27
PID 1880 wrote to memory of 1972	1880	d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db.exe	27
PID 1880 wrote to memory of 1972	1880	d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db.exe	27
PID 1972 wrote to memory of 460	1972	svchost.exe	28
PID 1972 wrote to memory of 460	1972	svchost.exe	28
PID 1972 wrote to memory of 460	1972	svchost.exe	28
PID 1972 wrote to memory of 460	1972	svchost.exe	28
PID 460 wrote to memory of 1724	460	net.exe	30
PID 460 wrote to memory of 1724	460	net.exe	30
PID 460 wrote to memory of 1724	460	net.exe	30
PID 460 wrote to memory of 1724	460	net.exe	30

C:\Users\Admin\AppData\Local\Temp\d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db.exe
"C:\Users\Admin\AppData\Local\Temp\d3c0640516e6d6dc9d4adadab671acf4e19d8767db085004a8c870d85e8c04db.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Program Files\Common Files\System\svchost.exe
  "C:\Program Files\Common Files\System\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\svchost.exe

Filesize
732KB

MD5
c48483fc1d890bd745b79e1d3f11a296

SHA1
d9172247570e99ec4cc754e884689f0856c40e04

SHA256
6d408751b7e7193b16d09e9f4ae4266bc150068776f6841174deac4bf3e1b8f6

SHA512
b2ca634902d3ec00e5a10dd7578048b1a75a58e63f6cd24e2a307a84061d1577d8dfa2124c9957c3c67e0b9432a1719006b17e872273e923b4d53c13362e4c36

Download Submit
\Program Files\Common Files\System\svchost.exe

Filesize
732KB

MD5
c48483fc1d890bd745b79e1d3f11a296

SHA1
d9172247570e99ec4cc754e884689f0856c40e04

SHA256
6d408751b7e7193b16d09e9f4ae4266bc150068776f6841174deac4bf3e1b8f6

SHA512
b2ca634902d3ec00e5a10dd7578048b1a75a58e63f6cd24e2a307a84061d1577d8dfa2124c9957c3c67e0b9432a1719006b17e872273e923b4d53c13362e4c36

Download Submit
\Program Files\Common Files\System\svchost.exe

Filesize
732KB

MD5
c48483fc1d890bd745b79e1d3f11a296

SHA1
d9172247570e99ec4cc754e884689f0856c40e04

SHA256
6d408751b7e7193b16d09e9f4ae4266bc150068776f6841174deac4bf3e1b8f6

SHA512
b2ca634902d3ec00e5a10dd7578048b1a75a58e63f6cd24e2a307a84061d1577d8dfa2124c9957c3c67e0b9432a1719006b17e872273e923b4d53c13362e4c36

Download Submit
memory/1972-58-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download