be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c

General

Target

be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe
Size

372KB
MD5

8d524d72f4345faea6a9a423ce2fde52
SHA1

bfb424c77857deef50e444bd7a592949411e948d
SHA256

be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c
SHA512

a008b4916235d95f1fb623e4ef88ed0cc861b1b573bf5db13fdf181e0d8b1b4309a9ef5b4f815c1d80275ec5d43ebbe22141d7d37d37b6279c90aa5689b1b6b7
SSDEEP

6144:bWIq5C5XEmrcfQxMJEENeeHv1vpZJKuKVOJ7KLaxEvC1Gqz:bamQfQwNeeNp2u6OE6aCH

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 1948	2044	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	27
PID 1948 set thread context of 1700	1948	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1700	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2044	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe
1948	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1948	2044	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	27
PID 2044 wrote to memory of 1948	2044	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	27
PID 2044 wrote to memory of 1948	2044	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	27
PID 2044 wrote to memory of 1948	2044	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	27
PID 2044 wrote to memory of 1948	2044	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	27
PID 2044 wrote to memory of 1948	2044	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	27
PID 2044 wrote to memory of 1948	2044	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	27
PID 2044 wrote to memory of 1948	2044	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	27
PID 2044 wrote to memory of 1948	2044	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	27
PID 1948 wrote to memory of 1700	1948	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	28
PID 1948 wrote to memory of 1700	1948	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	28
PID 1948 wrote to memory of 1700	1948	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	28
PID 1948 wrote to memory of 1700	1948	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	28
PID 1948 wrote to memory of 1700	1948	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	28
PID 1948 wrote to memory of 1700	1948	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	28
PID 1948 wrote to memory of 1700	1948	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	28
PID 1948 wrote to memory of 1700	1948	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	28
PID 1948 wrote to memory of 1700	1948	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	28
PID 1948 wrote to memory of 1700	1948	be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe	28

C:\Users\Admin\AppData\Local\Temp\be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe
"C:\Users\Admin\AppData\Local\Temp\be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe
  "C:\Users\Admin\AppData\Local\Temp\be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Users\Admin\AppData\Local\Temp\be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe
    "C:\Users\Admin\AppData\Local\Temp\be9c10532065d4bcf5b053eecb2766b7c1f4d18a8d1d28066f5926faae047f1c.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-78-0x0000000000410910-mapping.dmp

Download
memory/1700-77-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1700-73-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1700-75-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1700-71-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1700-83-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1700-68-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1700-69-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1700-86-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1700-81-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1700-82-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1948-59-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1948-56-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1948-80-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1948-62-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1948-57-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1948-67-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1948-63-0x0000000000401768-mapping.dmp

Download

Analysis

Sharing