938011ca2182016c5a3cd3c9224158087796ee37b10f5d914c5ded9103a12eeb

Analysis

max time kernel
148s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

938011ca2182016c5a3cd3c9224158087796ee37b10f5d914c5ded9103a12eeb.dll
Size

380KB
MD5

0c8d72344230c0625f366c89f6ff84f3
SHA1

67df7f93c4c30ed3c9d152e14eea96b3ec861750
SHA256

938011ca2182016c5a3cd3c9224158087796ee37b10f5d914c5ded9103a12eeb
SHA512

56697473ec59b45cf4a99f6f407d9a373ae0b78bcbd750c65354bd888cc44053673fa80013a2a6ef4c8ce77ba10febb3072252290d55fa525ee5b95ece8e8187
SSDEEP

6144:1hcH2NKtrIWbJvZ9k3wmgzPvYVdljGo+kK++EbZlUxxm+lCJ:vcH2NKqWbJB9kbkHYVTjGo+b+TUZO

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\-106-49336	rundll32.exe
File created	C:\Windows\SysWOW64\10b	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\938011ca2182016c5a3cd3c9224158087796ee37b10f5d914c5ded9103a12eeb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\938011ca2182016c5a3cd3c9224158087796ee37b10f5d914c5ded9103a12eeb.dll,#1
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  PID:1580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download