dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4

General

Target

dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
Size

198KB
MD5

82018436dbd9068b0cd46dc5bfca5f16
SHA1

86f8108e106166d2138d0f87e46a45ef4af11161
SHA256

dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4
SHA512

863ba28a5ad2bed1806a6b3814ea2238b06f350f48fc50ee0f161446b9dbad52761a0c9ea89b611332e7b5c3313ec3fa9ff1355b547b6169cbfd2f98d9cfb9a1
SSDEEP

3072:IJ797h5NGMhjNyHG3396HM0XUGXU2Fo21364EoiJeeI+StSqYLj8MfseRA11UO1h:q797CHenVW5GJZ2tNYLj8Mfsz4V7d0

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 2028	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	27
PID 1976 set thread context of 0	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
2028	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2028	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	27
PID 1976 wrote to memory of 2028	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	27
PID 1976 wrote to memory of 2028	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	27
PID 1976 wrote to memory of 2028	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	27
PID 1976 wrote to memory of 2028	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	27
PID 1976 wrote to memory of 2028	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	27
PID 1976 wrote to memory of 2028	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	27
PID 1976 wrote to memory of 2028	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	27
PID 1976 wrote to memory of 0	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
PID 1976 wrote to memory of 0	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
PID 1976 wrote to memory of 0	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
PID 1976 wrote to memory of 0	1976	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
PID 2028 wrote to memory of 1380	2028	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	6
PID 2028 wrote to memory of 1380	2028	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	6
PID 2028 wrote to memory of 1380	2028	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	6
PID 2028 wrote to memory of 1380	2028	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	6

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1380
- C:\Users\Admin\AppData\Local\Temp\dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
  "C:\Users\Admin\AppData\Local\Temp\dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Users\Admin\AppData\Local\Temp\dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
    "C:\Users\Admin\AppData\Local\Temp\dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/0-60-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1380-65-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1976-54-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1976-61-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2028-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2028-58-0x0000000000407C89-mapping.dmp

Download
memory/2028-62-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2028-63-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/2028-64-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2028-68-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing