Behavioral Report

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2023 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41d3c6bd3ce9f01f49f53ae5ef03c1d583b556e8327a4c6c27148809564738a2.exe
Size

4MB
MD5

1fcba4d5ff5a918c1cca93ff8f449891
SHA1

9ed7b9d33ac666ef65a295bc08ba35a04f7c1f2b
SHA256

41d3c6bd3ce9f01f49f53ae5ef03c1d583b556e8327a4c6c27148809564738a2
SHA512

bffd35f0d3b990d8baf94178c11a927e5f479fcf302ed19c1c7015f25de9e7ae677d2167a462534a2994a932be6feae137a48e3acd8ced66fd01a04c00f081bf
SSDEEP

98304:KbSpmrmc2lAu88lkcf5YjovKqGYiOE8oLj5aI/fSyo8aXmE/n:ELmZlq5gyjovK65E8olnSx8aXb/n

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

41d3c6bd3ce9f01f49f53ae5ef03c1d583b556e8327a4c6c27148809564738a2.exe

pid	process
544	41d3c6bd3ce9f01f49f53ae5ef03c1d583b556e8327a4c6c27148809564738a2.exe
544	41d3c6bd3ce9f01f49f53ae5ef03c1d583b556e8327a4c6c27148809564738a2.exe
544	41d3c6bd3ce9f01f49f53ae5ef03c1d583b556e8327a4c6c27148809564738a2.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

41d3c6bd3ce9f01f49f53ae5ef03c1d583b556e8327a4c6c27148809564738a2.exe

description ioc process

File opened for modification \??\PhysicalDrive0 41d3c6bd3ce9f01f49f53ae5ef03c1d583b556e8327a4c6c27148809564738a2.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	41d3c6bd3ce9f01f49f53ae5ef03c1d583b556e8327a4c6c27148809564738a2.exe

C:\Users\Admin\AppData\Local\Temp\41d3c6bd3ce9f01f49f53ae5ef03c1d583b556e8327a4c6c27148809564738a2.exe
"C:\Users\Admin\AppData\Local\Temp\41d3c6bd3ce9f01f49f53ae5ef03c1d583b556e8327a4c6c27148809564738a2.exe"
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\AppData\Local\LDSGameMaster\Store\360Base.dll
Filesize
862KB

MD5
ab00bed7cb2b7a8290e247fc34aaa5ff

SHA1
d6014e2920d9b587a8e12ae1ba0f1e1fc9edffa8

SHA256
ceffaedc050688e8dcc11ec30b703c63fefbfcf479558604fdb0ea42bcb497c0

SHA512
fbe3bf5e142d689bb15d05503fcf5c807aad5bcb99a02dc99590589ee66f7942a0d8365d470041972212dbdf9c232ab4bbab25e79d7bcd43f001a95d9012cca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\mgame[1].txt
Filesize
2B

MD5
444bcb3a3fcf8389296c49467f27e1d6

SHA1
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb

SHA256
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

SHA512
9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570

Download Submit
C:\Users\Admin\AppData\Local\Temp\{80EC312E-10FA-476f-BC94-758ED5046327}.tmp\7z.dll
Filesize
1MB

MD5
a46135bdd574092d85955070e72d5aad

SHA1
aad137b0a883fea22b7118778512ffc7865513bc

SHA256
aa57160684feb240a85da677caaf7cf6a08b7349d89ae9cb4a3476884d80aac5

SHA512
72188f348d9ae33e2b5a7886c80667cc3015bfac170249537baa9e31abf8d63ca198903206feb64887f1d509a1b9bfc9f54ede8b3aa26bee3f5c4375e5c6a24b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{8D82C977-EAF5-41f5-A1DA-1DD05AA96DDB}.tmp\360NetUL.dll
Filesize
234KB

MD5
cd03029957ebc78c0ca7a6c02a9ca846

SHA1
0044114b8073781479044f0294701be9611be2ac

SHA256
139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048

SHA512
14c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32

Download Submit
C:\Users\Admin\AppData\Local\Temp\{8D82C977-EAF5-41f5-A1DA-1DD05AA96DDB}.tmp\360NetUL.dll
Filesize
234KB

MD5
cd03029957ebc78c0ca7a6c02a9ca846

SHA1
0044114b8073781479044f0294701be9611be2ac

SHA256
139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048

SHA512
14c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32

Download Submit
C:\Users\Admin\AppData\Local\Temp\{8D82C977-EAF5-41f5-A1DA-1DD05AA96DDB}.tmp\NetBridge.dll
Filesize
238KB

MD5
8786d469338c30e0ba9fedfc62bd5197

SHA1
5fb12028ceae9772f938e1b98b699f0e02e32718

SHA256
beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f

SHA512
5db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{8D82C977-EAF5-41f5-A1DA-1DD05AA96DDB}.tmp\Utils\LDSBasic.dll
Filesize
2MB

MD5
c35ab236702291f1a2d090af8ea253d9

SHA1
d7f58f0f5fee6b26564af3c5d7ab6defe5a4608d

SHA256
c4dba892a9a1fb675d06dd615c4fc079e9f4e12a8368e8bd18e37137ed567f35

SHA512
87a3fa1927ad2fad117055411a471be95275a4d4bf99ee3ab522faee70067b239bb77ddd94c4300958607efd4a3fc071df2262754557fca2530e70f2c438a068

Download Submit
C:\Users\Admin\AppData\Local\Temp\{8D82C977-EAF5-41f5-A1DA-1DD05AA96DDB}.tmp\Utils\LDSBasic.dll
Filesize
2MB

MD5
c35ab236702291f1a2d090af8ea253d9

SHA1
d7f58f0f5fee6b26564af3c5d7ab6defe5a4608d

SHA256
c4dba892a9a1fb675d06dd615c4fc079e9f4e12a8368e8bd18e37137ed567f35

SHA512
87a3fa1927ad2fad117055411a471be95275a4d4bf99ee3ab522faee70067b239bb77ddd94c4300958607efd4a3fc071df2262754557fca2530e70f2c438a068

Download Submit