8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303

General

Target

8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll
Size

360KB
MD5

009a377f960e8986f17eb313c7e30d3b
SHA1

8a91baad1f7159f15dd70a3f41c30c2e2d70ae50
SHA256

8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303
SHA512

21d41a141da2501feebd2fe90692f8362a8b27a0d4b1664447e5f6858ca61d46a52cbb61bb97b8e89b93e9d074ed8253e595b4bd6a723d2aa2862ba7d65f33ff
SSDEEP

6144:WgLHUgZfOnsD/Z7NZejt4Pp4pJlrInQuIgVH4dLwvZ2D7O0X+a:WJ1i/Z7n+lzuIgeQ2DC0X+a

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

regsvr32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 regsvr32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8981EB1-2EF8-4201-923B-6E632FAEAF9A}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8981EB1-2EF8-4201-923B-6E632FAEAF9A}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8981EB1-2EF8-4201-923B-6E632FAEAF9A}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AE010487-B795-4876-959A-0B983CD55B78}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1BFE4153-B5F7-47D7-8F85-5BE0F842171F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1BFE4153-B5F7-47D7-8F85-5BE0F842171F}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE0AE08F-6166-45C6-AC42-32A27E033227}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C5484E0B-E072-4454-8A4E-572BED294211}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AE010487-B795-4876-959A-0B983CD55B78}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4270F4E2-D71D-43C0-B87E-16CD4C473CF2}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1BFE4153-B5F7-47D7-8F85-5BE0F842171F}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1BFE4153-B5F7-47D7-8F85-5BE0F842171F}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C5484E0B-E072-4454-8A4E-572BED294211}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49F77FDE-F983-454B-BD05-EBC28CA8E232}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8981EB1-2EF8-4201-923B-6E632FAEAF9A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4270F4E2-D71D-43C0-B87E-16CD4C473CF2}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1BFE4153-B5F7-47D7-8F85-5BE0F842171F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C5484E0B-E072-4454-8A4E-572BED294211}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8981EB1-2EF8-4201-923B-6E632FAEAF9A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4270F4E2-D71D-43C0-B87E-16CD4C473CF2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49F77FDE-F983-454B-BD05-EBC28CA8E232}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AE010487-B795-4876-959A-0B983CD55B78}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49F77FDE-F983-454B-BD05-EBC28CA8E232}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49F77FDE-F983-454B-BD05-EBC28CA8E232}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{930FC521-1AEE-4AE3-8E63-7CEA043D5DDC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8981EB1-2EF8-4201-923B-6E632FAEAF9A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{930FC521-1AEE-4AE3-8E63-7CEA043D5DDC}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8981EB1-2EF8-4201-923B-6E632FAEAF9A}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C5484E0B-E072-4454-8A4E-572BED294211}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE0AE08F-6166-45C6-AC42-32A27E033227}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49F77FDE-F983-454B-BD05-EBC28CA8E232}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AE010487-B795-4876-959A-0B983CD55B78}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{930FC521-1AEE-4AE3-8E63-7CEA043D5DDC}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE0AE08F-6166-45C6-AC42-32A27E033227}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C5484E0B-E072-4454-8A4E-572BED294211}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C5484E0B-E072-4454-8A4E-572BED294211}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4270F4E2-D71D-43C0-B87E-16CD4C473CF2}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1BFE4153-B5F7-47D7-8F85-5BE0F842171F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{930FC521-1AEE-4AE3-8E63-7CEA043D5DDC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE0AE08F-6166-45C6-AC42-32A27E033227}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AE010487-B795-4876-959A-0B983CD55B78}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AE010487-B795-4876-959A-0B983CD55B78}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{930FC521-1AEE-4AE3-8E63-7CEA043D5DDC}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2036 wrote to memory of 2008	2036	regsvr32.exe	regsvr32.exe
PID 2036 wrote to memory of 2008	2036	regsvr32.exe	regsvr32.exe
PID 2036 wrote to memory of 2008	2036	regsvr32.exe	regsvr32.exe
PID 2036 wrote to memory of 2008	2036	regsvr32.exe	regsvr32.exe
PID 2036 wrote to memory of 2008	2036	regsvr32.exe	regsvr32.exe
PID 2036 wrote to memory of 2008	2036	regsvr32.exe	regsvr32.exe
PID 2036 wrote to memory of 2008	2036	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll
2⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:2008

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-55-0x0000000000000000-mapping.dmp

Download
memory/2008-56-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/2036-54-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing