cf7b7ab4b0e8c086a1ab1453a59c4f2fcffb4c172bc260b76cccb6620a1bfc85

Analysis

max time kernel
37s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/GetInfo.dll
Size

41KB
MD5

6c9ded46c89d7f323976d021d9f2cfc3
SHA1

ca413c9b0e4f2b937e196c8d914c24ed18b13b4d
SHA256

56dabeb5edcb98556d8e9df07745c1bf7e82ae6c02d927ff3de2748741a5cfb0
SHA512

98f1d2645d4b20f9fb52332bbf52132d8d2aad4f4cc74cf760293be656f27160312029a7fc9c353fdf315ae7104cf71ef99299e4aa5f6d29373e45a736fa507e
SSDEEP

768:WCpqOQdwHPoBuUSdB6zW/U9Bok+VN5KvwEW3XkjTkd4Btd8VeGi6B8xZ:RpqOQYM9SzsoBBta78E96mxZ

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1788 wrote to memory of 848	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 848	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 848	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 848	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 848	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 848	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 848	1788	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发器 2014-06-18绿色版\豪迪QQ群发器 2014\GetInfo.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发器 2014-06-18绿色版\豪迪QQ群发器 2014\GetInfo.dll",#1
2⤵
- Writes to the Master Boot Record (MBR)
PID:848

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-54-0x0000000000000000-mapping.dmp

Download
memory/848-55-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download