0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d

General

Target

0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
Size

400KB
MD5

349fad42277afb30c8324b3b83c57d35
SHA1

bd99021a4e77d1ea517f91981c9b34cef217bea2
SHA256

0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d
SHA512

d8b07c6af456c55049d1fdf916a8a2ba77ca4e138ffb258f6a7419fb4ece6ac9ba843bc9b35e4d45875b1d15d4fa74a22f1abfd86bdcb7ad2a1d2448505f1391
SSDEEP

6144:HMkXEBJ4f03VZSaH8WwQVcD4fsomxbHQlGUi2jhsmHplLxPRJfsoy/Oti+azNC:AVoIJwQVcD4fnGUJsmHplLxJJf5uzY

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2012	main5.exe
1732	netlos.exe

Loads dropped DLL 2 IoCs

pid	Process
2012	main5.exe
2012	main5.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	main5.exe
File opened for modification	\??\PhysicalDrive0	netlos.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchoct.exe	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
File opened for modification	C:\Windows\SysWOW64\rmot2.exe	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
File opened for modification	C:\Windows\SysWOW64\rmot.exe	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
File opened for modification	C:\Windows\SysWOW64\netloss.exe	main5.exe
File created	C:\Windows\SysWOW64\dllcache\SOUNDMAN.exe	main5.exe
File created	C:\Windows\SysWOW64\log.sql	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
File opened for modification	C:\Windows\SysWOW64\svchoct2.exe	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
File created	C:\Windows\SysWOW64\netloss.exe	main5.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\SOUNDMAN.exe	main5.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\main52.tmp	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
File opened for modification	C:\Windows\main5.tmp	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
1736	taskkill.exe
1088	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	1736	taskkill.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1364	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
2012	main5.exe
1732	netlos.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2012	1364	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe	27
PID 1364 wrote to memory of 2012	1364	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe	27
PID 1364 wrote to memory of 2012	1364	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe	27
PID 1364 wrote to memory of 2012	1364	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe	27
PID 2012 wrote to memory of 1732	2012	main5.exe	28
PID 2012 wrote to memory of 1732	2012	main5.exe	28
PID 2012 wrote to memory of 1732	2012	main5.exe	28
PID 2012 wrote to memory of 1732	2012	main5.exe	28
PID 1732 wrote to memory of 1736	1732	netlos.exe	29
PID 1732 wrote to memory of 1736	1732	netlos.exe	29
PID 1732 wrote to memory of 1736	1732	netlos.exe	29
PID 1732 wrote to memory of 1736	1732	netlos.exe	29
PID 1732 wrote to memory of 1088	1732	netlos.exe	30
PID 1732 wrote to memory of 1088	1732	netlos.exe	30
PID 1732 wrote to memory of 1088	1732	netlos.exe	30
PID 1732 wrote to memory of 1088	1732	netlos.exe	30

C:\Users\Admin\AppData\Local\Temp\0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
"C:\Users\Admin\AppData\Local\Temp\0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\main5.exe
  "C:\Windows\main5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\netlos.exe
    "C:\Windows\system32\netlos.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netlos.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1736
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im svchoct.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\log.sql

Filesize
20B

MD5
7c22628b08f0af2e7449794ff4958136

SHA1
adbaef0b6981ead722870796e1b1e59531878790

SHA256
324b3ff2551cf509ab487164603d9e9776ba1520394dc973d85c619fa9b8141d

SHA512
b5a41a1ca0853a98afc8459f671547cd40b9116afa04add0eb7c9134c8d36a71ad4ebed87dab631eb63ee5f5b0a9957410a67f6a947823a6843d665fbb0c1424

Download Submit
C:\Windows\SysWOW64\netlos.exe

Filesize
304KB

MD5
756c1a61ddc096120a220f9ace927d5c

SHA1
fbba17a4f806839a5a3f71fdef70d05f24cf66d6

SHA256
8cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9

SHA512
4994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0

Download Submit
C:\Windows\SysWOW64\netlos.exe

Filesize
304KB

MD5
756c1a61ddc096120a220f9ace927d5c

SHA1
fbba17a4f806839a5a3f71fdef70d05f24cf66d6

SHA256
8cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9

SHA512
4994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0

Download Submit
C:\Windows\main5.exe

Filesize
304KB

MD5
756c1a61ddc096120a220f9ace927d5c

SHA1
fbba17a4f806839a5a3f71fdef70d05f24cf66d6

SHA256
8cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9

SHA512
4994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0

Download Submit
C:\Windows\main5.exe

Filesize
304KB

MD5
756c1a61ddc096120a220f9ace927d5c

SHA1
fbba17a4f806839a5a3f71fdef70d05f24cf66d6

SHA256
8cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9

SHA512
4994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0

Download Submit
\Windows\SysWOW64\netlos.exe

Filesize
304KB

MD5
756c1a61ddc096120a220f9ace927d5c

SHA1
fbba17a4f806839a5a3f71fdef70d05f24cf66d6

SHA256
8cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9

SHA512
4994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0

Download Submit
\Windows\SysWOW64\netlos.exe

Filesize
304KB

MD5
756c1a61ddc096120a220f9ace927d5c

SHA1
fbba17a4f806839a5a3f71fdef70d05f24cf66d6

SHA256
8cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9

SHA512
4994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0

Download Submit
memory/1364-56-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing