f049944b5e95457a5d8028ea49104e8777519061756226a07f7f671dc0d9820e

Analysis

max time kernel
117s
max time network
159s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xeogp_30340.exe
Size

1.9MB
MD5

3fa87385441b44221f407d4235b7c4de
SHA1

14b3369ca3c0c23736f4ecacb14582091f98a8c4
SHA256

6a5fb367f94fcf89add5b223fa9acf48c0ed8cf59cef2c861b73a185dfee7e44
SHA512

1ee134fad0bdbcc88ec1c71fdd003175cd4f35c70a5a0075fc3bb6da75a9abfc43d13138831dc0c8cc0f3dea1a06bb63a3410617a8cf1b232e7aecd3109375d3
SSDEEP

49152:O2y6li4Yy7G+OZ3rg7+SPIH4k9dNprVnN2+MRyZZtUAuPmfkK:jy6liyjOZ3W+yIXpVnN/MRQZ6AUen

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 6 IoCs

Processes:

xeogp_30340.exe

pid process

1908 xeogp_30340.exe
1908 xeogp_30340.exe
1908 xeogp_30340.exe
1908 xeogp_30340.exe
1908 xeogp_30340.exe
1908 xeogp_30340.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

xeogp_30340.exe

description ioc process

File opened for modification \??\PhysicalDrive0 xeogp_30340.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1908	xeogp_30340.exe
1908	xeogp_30340.exe
1908	xeogp_30340.exe
1908	xeogp_30340.exe
1908	xeogp_30340.exe
1908	xeogp_30340.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	xeogp_30340.exe

Modifies registry class 3 IoCs

Processes:

xeogp_30340.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid	xeogp_30340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd	xeogp_30340.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid\SequenceID = e90d1cc668381644a45f8ea05876a024	xeogp_30340.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

xeogp_30340.exe

pid process

1908 xeogp_30340.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

xeogp_30340.exe

pid process

1908 xeogp_30340.exe

pid	process
1908	xeogp_30340.exe

pid	process
1908	xeogp_30340.exe

C:\Users\Admin\AppData\Local\Temp\xeogp_30340.exe
"C:\Users\Admin\AppData\Local\Temp\xeogp_30340.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstE75.tmp\BDMDownload.dll

Filesize
158KB

MD5
b62367fe2d02b8f47914b088a006d50c

SHA1
3743c953e48e6f3f76689423ba9c1ed25e9f86d3

SHA256
cbd4c5b6b945620e8b65752dff5a0f0900fc5de2dda8daf3cdda68b1661420b7

SHA512
c010e3cc736ac1e10c6af44132d831df34d09bf1e7d1e96fb5c9f571cade04462d442c4b0fd84de92dc68d753a0beab0b4081122d53d516406f0d3c1ec1e0dbb

Download Submit
\Users\Admin\AppData\Local\Temp\nstE75.tmp\BDMNetGetInfo.dll

Filesize
314KB

MD5
12f98be1d919784370eb0f87e78b60d8

SHA1
d07de2227b2ec68545be0adeb042af457d68f9e2

SHA256
63e34375374ae6cc695c0bc03f1f9aad67e068fc51962fd25edbf2fbeceda9f9

SHA512
ab2fcdd3eb7b58f044a855b5cae744bc1b3be599cf0d22ee93ccce2e97cb3bc1f36ea2c1ed75013c76f8c9e4071ba29710595c3a57cda2470885ee9293fc2d8d

Download Submit
\Users\Admin\AppData\Local\Temp\nstE75.tmp\BDMSkin.dll

Filesize
1.3MB

MD5
39257175ac9c90199c69aea1a7bcbda0

SHA1
6cf4a8dedf37d24ce902f34fa66120a214e1a2cc

SHA256
84d5fb0a7cf1bc1e4bbd0de51d3b7eb04bb92af9a1fc3675601b382a5f11d9fc

SHA512
4a71d0ac3df53b25509205e9ed0bf781cbefa2ba6307501ae336488c8a3f7f627b8d01f861adbf47986e168abab5a06b36848f87cbcf27fe846e5f0ffc3a9f53

Download Submit
\Users\Admin\AppData\Local\Temp\nstE75.tmp\System.dll

Filesize
18KB

MD5
1c951bbcbc780046d6be1079a04870a4

SHA1
a5bae7d838973154e6fac69b1c5ff7d2cda01906

SHA256
d23676fbcf76355d1af68e7b32964b837243349920921b2ec74d97554809a65e

SHA512
62c3686baed2232f7d8ddc8f48a41761812b5b2a67f3a689b7a43275f077842366abc13c7e8259613bfd9df25cf467e4001337c1454aec910abce121d551e2d8

Download Submit
\Users\Admin\AppData\Local\Temp\nstE75.tmp\dl.dll

Filesize
1.9MB

MD5
763b532d651f0ad5e135d9b57bf4fba4

SHA1
23f1302f904a67a1fe0d48e11a435c2f36336196

SHA256
50b3c45ede6fd2d77c4f040242b2174289767b18a3a084e7046133b05f93e173

SHA512
a4ec0f5bfa30d3558935f4075a75aebf080ece324a550c573d8a424730693b030cd26b4862973e8da8937e610c287d64e96c2fd952b59324ed1822919a00737c

Download Submit
\Users\Admin\AppData\Local\Temp\nstE75.tmp\tmpb4qr1m.dll

Filesize
2.4MB

MD5
4616a41582a66b253f8fd53097823e37

SHA1
53a7eb9c18048d1155176a3aed40b362f70b549b

SHA256
54048e9c53deca43800e7f1e2927b035b01109f86eb2013372419ab8a86f8bf8

SHA512
e64d43ed8989d6fd74521ae6c3a20409575c7b926274f8d5943f03ac5fc8cef0044dcc3d919cfa0cff3cc98392cc94ed81410e00018eb6871240d923cbdb9158

Download Submit
memory/1908-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1908-67-0x0000000004E50000-0x000000000503D000-memory.dmp

Filesize
1.9MB

Download