fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210

General

Target

fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
Size

364KB
MD5

82db0d00a83c02c144941dd7082827b0
SHA1

fad1c8a1d5fdab36743884e6b3342f3ebac2da42
SHA256

fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210
SHA512

f50a8ed53fb8f754f77898bdf2a1a5c492acb32513481f0c033567a2e10f540f6e87dc72a91c2b2a94ab5d74b6dd567be0fadd32b4627cda1e9bdbb589600da4
SSDEEP

6144:RypUBUqSkw5iItrSRU7h/9iDSVdFHGie1YEFIgzodnfKx/8GcsMBvMCmJp:cyUb/D9GO1iDK/HGioYyFz0+esTCm

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\skynewp\\svchost.exe"	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\skynewp\\svchost.exe"	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B7LOW32-3B2G-2VC0-G0EB-F2W5W4Q5TGMA}	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B7LOW32-3B2G-2VC0-G0EB-F2W5W4Q5TGMA}\StubPath = "C:\\Windows\\skynewp\\svchost.exe s"	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1988-80-0x0000000013400000-0x00000000134AC000-memory.dmp	upx
behavioral1/memory/1988-83-0x0000000013400000-0x00000000134AC000-memory.dmp	upx
behavioral1/memory/1988-85-0x0000000013400000-0x00000000134AC000-memory.dmp	upx
behavioral1/memory/1988-89-0x0000000013400000-0x00000000134AC000-memory.dmp	upx
behavioral1/memory/1988-91-0x0000000013400000-0x00000000134AC000-memory.dmp	upx
behavioral1/memory/1988-90-0x0000000013400000-0x00000000134AC000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\skynewp\\svchost.exe"	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\skynewp\\svchost.exe"	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 904 set thread context of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 1380 set thread context of 1988	1380	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	28

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\skynewp\svchost.exe	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
File opened for modification	C:\Windows\skynewp\svchost.exe	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
File opened for modification	C:\Windows\skynewp\	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 904 wrote to memory of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 904 wrote to memory of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 904 wrote to memory of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 904 wrote to memory of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 904 wrote to memory of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 904 wrote to memory of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 904 wrote to memory of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 904 wrote to memory of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 904 wrote to memory of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 904 wrote to memory of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 904 wrote to memory of 1380	904	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	27
PID 1380 wrote to memory of 1988	1380	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	28
PID 1380 wrote to memory of 1988	1380	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	28
PID 1380 wrote to memory of 1988	1380	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	28
PID 1380 wrote to memory of 1988	1380	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	28
PID 1380 wrote to memory of 1988	1380	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	28
PID 1380 wrote to memory of 1988	1380	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	28
PID 1380 wrote to memory of 1988	1380	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	28
PID 1380 wrote to memory of 1988	1380	fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe	28

C:\Users\Admin\AppData\Local\Temp\fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
"C:\Users\Admin\AppData\Local\Temp\fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
  C:\Users\Admin\AppData\Local\Temp\fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Users\Admin\AppData\Local\Temp\fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
    C:\Users\Admin\AppData\Local\Temp\fe9840d98728e464e92a659cb7fb65803f321b019ee323a102e82d99255f3210.exe
    3⤵
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XtremeServerSource.dat

Filesize
204KB

MD5
afa8ed2fc8eac7fc0c232c77e76e95aa

SHA1
19f70e5f69437d0ffade6fb7b2a6a1d801f60d4c

SHA256
14560b0d5e3bebd29443ee464a0caf0bb49bdc26c819bbde3d20e81aa354c564

SHA512
4f0806a20b054a6911f8ada96cac29a362cc3b1fb8d0d132a7e2ca4f168730517a2f5c4fa3b56e4dfdfe0a9e8c635a05baf5575cee645d222857866bb8aa9c6b

Download Submit
memory/904-77-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/904-55-0x0000000000330000-0x0000000000372000-memory.dmp

Filesize
264KB

Download
memory/904-56-0x0000000000840000-0x0000000000843000-memory.dmp

Filesize
12KB

Download
memory/904-54-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1380-76-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1380-62-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1380-65-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1380-68-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1380-70-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1380-73-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1380-60-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1380-78-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1380-58-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1380-57-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1988-79-0x0000000013400000-0x00000000134AC000-memory.dmp

Filesize
688KB

Download
memory/1988-83-0x0000000013400000-0x00000000134AC000-memory.dmp

Filesize
688KB

Download
memory/1988-85-0x0000000013400000-0x00000000134AC000-memory.dmp

Filesize
688KB

Download
memory/1988-88-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1988-89-0x0000000013400000-0x00000000134AC000-memory.dmp

Filesize
688KB

Download
memory/1988-91-0x0000000013400000-0x00000000134AC000-memory.dmp

Filesize
688KB

Download
memory/1988-90-0x0000000013400000-0x00000000134AC000-memory.dmp

Filesize
688KB

Download
memory/1988-80-0x0000000013400000-0x00000000134AC000-memory.dmp

Filesize
688KB

Download
memory/1988-94-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1988-93-0x0000000013478000-0x00000000134AB000-memory.dmp

Filesize
204KB

Download
memory/1988-95-0x0000000013401000-0x0000000013478000-memory.dmp

Filesize
476KB

Download
memory/1988-96-0x0000000013478000-0x00000000134AB000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads