Overview
overview
9Static
static
9ͻ�...PI.dll
windows7-x64
6ͻ�...PI.dll
windows10-2004-x64
6ͻ�...dx.dll
windows7-x64
1ͻ�...dx.dll
windows10-2004-x64
8ͻ�...dt.dll
windows7-x64
1ͻ�...dt.dll
windows10-2004-x64
1ͻ�...��.exe
windows7-x64
8ͻ�...��.exe
windows10-2004-x64
8ͻ�...�1.exe
windows7-x64
8ͻ�...�1.exe
windows10-2004-x64
8Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 20:39
Behavioral task
behavioral1
Sample
ͻ/CrackCaptchaAPI.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ͻ/CrackCaptchaAPI.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
ͻ/rgfdx.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
ͻ/rgfdx.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
ͻ/sydt.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
ͻ/sydt.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
ͻ/ͻ.exe
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
ͻ/ͻ.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
ͻ/ͻ1.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
ͻ/ͻ1.exe
Resource
win10v2004-20220812-en
General
-
Target
ͻ/ͻ1.exe
-
Size
2.7MB
-
MD5
405ce52ed5977b753e4d3262d9bc6116
-
SHA1
52afe341292dbf56a33de35938dd141084892726
-
SHA256
36a11c9a02418abaf679da0632c084b0855e0f419ff402416ba3b6f65273fd37
-
SHA512
2cdbc0e2b680cd024cb454f3dcda3af16895d110c145fbdd3fb2b0e8b2034c08326e6279a559ddb49635c81d5355820be1a27bb450916a478af03acce906a76b
-
SSDEEP
49152:pjEAuVU9p3Cb03IFTtyp6ano1RYsj4Eh5SLimp:lEAsULCb03Bp6FYskEhi
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral10/memory/396-134-0x0000000000400000-0x00000000006AB200-memory.dmp upx behavioral10/memory/396-140-0x0000000000400000-0x00000000006AB200-memory.dmp upx -
Processes:
resource yara_rule behavioral10/memory/396-132-0x0000000002690000-0x000000000285D000-memory.dmp vmprotect behavioral10/memory/396-135-0x0000000002690000-0x000000000285D000-memory.dmp vmprotect behavioral10/memory/396-136-0x0000000002690000-0x000000000285D000-memory.dmp vmprotect -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
ͻ1.exedescription ioc process File opened for modification \??\PhysicalDrive0 ͻ1.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ͻ1.exepid process 396 ͻ1.exe 396 ͻ1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ͻ1.exepid process 396 ͻ1.exe 396 ͻ1.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-132-0x0000000002690000-0x000000000285D000-memory.dmpFilesize
1.8MB
-
memory/396-134-0x0000000000400000-0x00000000006AB200-memory.dmpFilesize
2.7MB
-
memory/396-135-0x0000000002690000-0x000000000285D000-memory.dmpFilesize
1.8MB
-
memory/396-136-0x0000000002690000-0x000000000285D000-memory.dmpFilesize
1.8MB
-
memory/396-140-0x0000000000400000-0x00000000006AB200-memory.dmpFilesize
2.7MB
-
memory/396-141-0x0000000002690000-0x000000000285D000-memory.dmpFilesize
1.8MB