b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760

General

Target

b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
Size

404KB
MD5

6fc529de07d137f3ee1ba04f5ff6e5c4
SHA1

4e6884206ce49342ebef7d03dd81dd6dbed7a60f
SHA256

b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760
SHA512

c725d789f0d50333ec620b2ebfb52261b12cf1d7d3724b67d506c6aeca698777b7e535bb9fe541aa3627e1a7272cd2e028db53fc3c8f69a41bf2bb2d73934ca8
SSDEEP

12288:35Bevhp0wpE9z/uXagSAiLNZQ4i696+IUvbOI2/Kmu7wxwj:gWqJSzZOCIiiymuf

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1956-56-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\MBR Regenerator\core\engine86.$$A	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
File created	C:\Windows\MBR Regenerator\core\engine86.$AA	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
File created	C:\Windows\MBR Regenerator\core\hosts.$$A	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
File created	C:\Windows\MBR Regenerator\core\scanner.$$A	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
File created	C:\Windows\MBR Regenerator\core\sfc32\sfc.$$A	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
File opened for modification	C:\Windows\MBR Regenerator\core\sfc64\sfc.exe	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
File created	C:\Windows\MBR Regenerator\core\engine64.$$A	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
File created	C:\Windows\MBR Regenerator\core\sfc64\sfc.$$A	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
File created	C:\Windows\MBR Regenerator\core\sfc64\sfc.$AA	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
File created	C:\Windows\MBR Regenerator\core\sleep.$$A	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
File created	C:\Windows\MBR Regenerator\engine.$$A	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
File created	C:\Windows\MBR Regenerator\core\bootsect.$$A	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1784	1956	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe	28
PID 1956 wrote to memory of 1784	1956	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe	28
PID 1956 wrote to memory of 1784	1956	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe	28
PID 1956 wrote to memory of 1784	1956	b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe	28
PID 1784 wrote to memory of 768	1784	cmd.exe	30
PID 1784 wrote to memory of 768	1784	cmd.exe	30
PID 1784 wrote to memory of 768	1784	cmd.exe	30
PID 1784 wrote to memory of 768	1784	cmd.exe	30
PID 1784 wrote to memory of 672	1784	cmd.exe	31
PID 1784 wrote to memory of 672	1784	cmd.exe	31
PID 1784 wrote to memory of 672	1784	cmd.exe	31
PID 1784 wrote to memory of 672	1784	cmd.exe	31
PID 1784 wrote to memory of 1164	1784	cmd.exe	32
PID 1784 wrote to memory of 1164	1784	cmd.exe	32
PID 1784 wrote to memory of 1164	1784	cmd.exe	32
PID 1784 wrote to memory of 1164	1784	cmd.exe	32
PID 1784 wrote to memory of 1920	1784	cmd.exe	33
PID 1784 wrote to memory of 1920	1784	cmd.exe	33
PID 1784 wrote to memory of 1920	1784	cmd.exe	33
PID 1784 wrote to memory of 1920	1784	cmd.exe	33
PID 1784 wrote to memory of 588	1784	cmd.exe	34
PID 1784 wrote to memory of 588	1784	cmd.exe	34
PID 1784 wrote to memory of 588	1784	cmd.exe	34
PID 1784 wrote to memory of 588	1784	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
"C:\Users\Admin\AppData\Local\Temp\b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Windows\MBR Regenerator\engine.cmd""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\mode.com
    mode con: cols=80 lines=16
    3⤵
    PID:768
- - C:\Windows\SysWOW64\reg.exe
    REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
    3⤵
    PID:672
- - C:\Windows\SysWOW64\findstr.exe
    FINDSTR "7"
    3⤵
    PID:1164
- - C:\Windows\SysWOW64\reg.exe
    REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\find.exe
    find /i "Ultimate"
    3⤵
    PID:588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\MBR Regenerator\engine.cmd

Filesize
16KB

MD5
9807689728c81d44376164beaed5498f

SHA1
94052d250b3d6dba4cd002b04fa8c933353a429a

SHA256
c2e381524ea02e1a447c0f091da8d695ba5be58c707f09486080a282bceaeb05

SHA512
ab71c1686d858e80eec4d04d220b140dce08c14f811bdd034eaf77bf616202341356b127c65777a85af629633108b98c5aeddb94c70fc6a2342bc4b5d49ced09

Download Submit
memory/1956-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads