Overview
overview
10Static
static
8mirserver/...er.exe
windows7-x64
1mirserver/...er.exe
windows10-2004-x64
mirserver/...er.exe
windows7-x64
1mirserver/...er.exe
windows10-2004-x64
1mirserver/...er.exe
windows7-x64
1mirserver/...er.exe
windows10-2004-x64
1mirserver/...te.exe
windows7-x64
mirserver/...te.exe
windows10-2004-x64
1mirserver/...rv.exe
windows7-x64
1mirserver/...rv.exe
windows10-2004-x64
mirserver/...��.htm
windows7-x64
10mirserver/...��.htm
windows10-2004-x64
1mirserver/...tm.url
windows7-x64
1mirserver/...tm.url
windows10-2004-x64
1mirserver/...tm.url
windows7-x64
1mirserver/...tm.url
windows10-2004-x64
mirserver/...ml.url
windows7-x64
1mirserver/...ml.url
windows10-2004-x64
1mirserver/...��.url
windows7-x64
1mirserver/...��.url
windows10-2004-x64
1mirserver/...gm.dll
windows7-x64
5mirserver/...gm.dll
windows10-2004-x64
5mirserver/...al.dll
windows7-x64
1mirserver/...al.dll
windows10-2004-x64
1mirserver/...er.exe
windows7-x64
6mirserver/...er.exe
windows10-2004-x64
5mirserver/...��.htm
windows7-x64
10mirserver/...��.htm
windows10-2004-x64
1mirserver/...��.htm
windows7-x64
10mirserver/...��.htm
windows10-2004-x64
1mirserver/...te.exe
windows7-x64
1mirserver/...te.exe
windows10-2004-x64
1Analysis
-
max time kernel
224s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:54
Behavioral task
behavioral1
Sample
mirserver/DBServer/DBServer.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
mirserver/DBServer/DBServer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
mirserver/GameCenter.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
mirserver/GameCenter.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
mirserver/LogServer/LogDataServer.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
mirserver/LogServer/LogDataServer.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
mirserver/LoginGate/LoginGate.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
mirserver/LoginGate/LoginGate.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
mirserver/LoginSrv/LoginSrv.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
mirserver/LoginSrv/LoginSrv.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
mirserver/LoginSrv/Readme-˵.htm
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
mirserver/LoginSrv/Readme-˵.htm
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
mirserver/LoginSrv/Ҫϰ汾.htm.url
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
mirserver/LoginSrv/Ҫϰ汾.htm.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
mirserver/LoginSrv/÷.htm.url
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
mirserver/LoginSrv/÷.htm.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
mirserver/LoginSrv/ҵ汾.html.url
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
mirserver/LoginSrv/ҵ汾.html.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
mirserver/LoginSrv/.url
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
mirserver/LoginSrv/.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
mirserver/Mir200/000gm.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
mirserver/Mir200/000gm.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
mirserver/Mir200/IPLocal.dll
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
mirserver/Mir200/IPLocal.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
mirserver/Mir200/M2Server.exe
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
mirserver/Mir200/M2Server.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
mirserver/Readme-˵.htm
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
mirserver/Readme-˵.htm
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
mirserver/RunGate/Readme-˵.htm
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
mirserver/RunGate/Readme-˵.htm
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
mirserver/RunGate/RunGate.exe
Resource
win7-20221111-en
Behavioral task
behavioral32
Sample
mirserver/RunGate/RunGate.exe
Resource
win10v2004-20221111-en
General
-
Target
mirserver/Mir200/M2Server.exe
-
Size
1.1MB
-
MD5
d195231bd76fae92717f768c8ce955a3
-
SHA1
27343d2ca343cc20b9cc50682cd62c9565924773
-
SHA256
16528c7c0a449d3dc3c569ae412886e579b8efe6ce4a27665175b113675f0a79
-
SHA512
3713df142b4cd2d53a80f91e79c5fd1d484e898d37855b47153c5e881eb18149e11c0fb1398b868f0ce5c45baabdc4694d16d6316a0f5d437b0ee20e817b9972
-
SSDEEP
24576:uvf+2nh9rbWn/L9re8IuRRxnPFfSyvsShagqNVYWtyH5n+:u3lwBrlIuRFlv3lgTIn+
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
M2Server.exedescription ioc process File opened for modification \??\PhysicalDrive0 M2Server.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
M2Server.exepid process 276 M2Server.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/276-54-0x0000000000400000-0x00000000007C4000-memory.dmpFilesize
3.8MB
-
memory/276-55-0x0000000076031000-0x0000000076033000-memory.dmpFilesize
8KB
-
memory/276-56-0x0000000000400000-0x00000000007C4000-memory.dmpFilesize
3.8MB
-
memory/276-57-0x0000000000400000-0x00000000007C4000-memory.dmpFilesize
3.8MB
-
memory/276-58-0x0000000000400000-0x00000000007C4000-memory.dmpFilesize
3.8MB