27eab496d0b63d52c18cee063110d9d479523b58426bfcb58e420a5cae087c54

General

Target

krnl_bootstrapper.exe
Size

1.2MB
MD5

f14153bbd95fc26d9ccea77c49cf09b9
SHA1

cb59f900711ea751c4322b4dab50fa2c0ee70b33
SHA256

27eab496d0b63d52c18cee063110d9d479523b58426bfcb58e420a5cae087c54
SHA512

7f7618cf6f15d85e82cbfff07ca6e1df0aa763d64d6a37fb659f1612b950d16a15b723ec053765e991485e74a7301617019b166dcaa759ed6f1a281a9ebc4ed0
SSDEEP

12288:aBVCrK2jsP3zv+FSF68GANNhWLS0B6L+FOCN+AzrnxdanvzFzho:SU7ecSgL6y+gk+rnxdarFu

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

7za.exe7za.exe

pid process

812 7za.exe
788 7za.exe
Loads dropped DLL 3 IoCs

Processes:

krnl_bootstrapper.exe

pid process

528 krnl_bootstrapper.exe
528 krnl_bootstrapper.exe
528 krnl_bootstrapper.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

krnl_bootstrapper.exe

pid process

528 krnl_bootstrapper.exe
528 krnl_bootstrapper.exe
528 krnl_bootstrapper.exe

pid	process
812	7za.exe
788	7za.exe

pid	process
528	krnl_bootstrapper.exe
528	krnl_bootstrapper.exe
528	krnl_bootstrapper.exe

pid	process
528	krnl_bootstrapper.exe
528	krnl_bootstrapper.exe
528	krnl_bootstrapper.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

krnl_bootstrapper.exe7za.exe7za.exe

description	pid	process
Token: SeDebugPrivilege	528	krnl_bootstrapper.exe
Token: SeRestorePrivilege	812	7za.exe
Token: 35	812	7za.exe
Token: SeSecurityPrivilege	812	7za.exe
Token: SeSecurityPrivilege	812	7za.exe
Token: SeRestorePrivilege	788	7za.exe
Token: 35	788	7za.exe
Token: SeSecurityPrivilege	788	7za.exe
Token: SeSecurityPrivilege	788	7za.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

krnl_bootstrapper.exe

description	pid	process	target process
PID 528 wrote to memory of 812	528	krnl_bootstrapper.exe	7za.exe
PID 528 wrote to memory of 812	528	krnl_bootstrapper.exe	7za.exe
PID 528 wrote to memory of 812	528	krnl_bootstrapper.exe	7za.exe
PID 528 wrote to memory of 812	528	krnl_bootstrapper.exe	7za.exe
PID 528 wrote to memory of 788	528	krnl_bootstrapper.exe	7za.exe
PID 528 wrote to memory of 788	528	krnl_bootstrapper.exe	7za.exe
PID 528 wrote to memory of 788	528	krnl_bootstrapper.exe	7za.exe
PID 528 wrote to memory of 788	528	krnl_bootstrapper.exe	7za.exe

C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528

C:\Users\Admin\Documents\krnl\7za.exe
"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\Monaco.zip" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:812

C:\Users\Admin\Documents\krnl\7za.exe
"C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\src.7z" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:788

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\krnl\7za.exe
Filesize
628KB

MD5
ec79cabd55a14379e4d676bb17d9e3df

SHA1
15626d505da35bfdb33aea5c8f7831f616cabdba

SHA256
44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

SHA512
00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

Download Submit
C:\Users\Admin\Documents\krnl\7za.exe
Filesize
628KB

MD5
ec79cabd55a14379e4d676bb17d9e3df

SHA1
15626d505da35bfdb33aea5c8f7831f616cabdba

SHA256
44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

SHA512
00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

Download Submit
C:\Users\Admin\Documents\krnl\7za.exe
Filesize
628KB

MD5
ec79cabd55a14379e4d676bb17d9e3df

SHA1
15626d505da35bfdb33aea5c8f7831f616cabdba

SHA256
44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

SHA512
00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

Download Submit
C:\Users\Admin\Documents\krnl\bin\Monaco.zip
Filesize
641KB

MD5
1a19fd7c42169c76e75e685dca02c190

SHA1
f16b4697bcd348d44965bf9ded731523db9bd606

SHA256
d686209afbbe718dc0506356e934ff190c1259a174aba12ef40a2fe7a014a331

SHA512
93d27188aab662ffffd78cfc31d100f161656ef37fe4f420a2cc2d514c935bce85b1e9b54eb374c94ba0ac75d0624e24676f8e359c32c9d3485aa5d7bbb14dd4

Download Submit
C:\Users\Admin\Documents\krnl\bin\src.7z
Filesize
52.5MB

MD5
7c380ecd5bc2cd51511d0ee5b58df745

SHA1
615749979477621579dd9b04ada8d4dcd9430f1e

SHA256
38e1b82e4c9a2a8159c1c60afe7668855351a6e9b52fb13f6dcc633202abaf07

SHA512
110836411f3b44f1df8ecc5890f59d7b5b10d6175f627cc160f0fa5bbc72408c1463ac7067d9787ff9a18e50b9460edf2e2f0b3a418532cc9a273965da1cc1de

Download Submit
\Users\Admin\Documents\krnl\7za.exe
Filesize
628KB

MD5
ec79cabd55a14379e4d676bb17d9e3df

SHA1
15626d505da35bfdb33aea5c8f7831f616cabdba

SHA256
44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

SHA512
00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

Download Submit
\Users\Admin\Documents\krnl\7za.exe
Filesize
628KB

MD5
ec79cabd55a14379e4d676bb17d9e3df

SHA1
15626d505da35bfdb33aea5c8f7831f616cabdba

SHA256
44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

SHA512
00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

Download Submit
\Users\Admin\Documents\krnl\7za.exe
Filesize
628KB

MD5
ec79cabd55a14379e4d676bb17d9e3df

SHA1
15626d505da35bfdb33aea5c8f7831f616cabdba

SHA256
44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

SHA512
00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

Download Submit
memory/528-59-0x0000000000D30000-0x0000000000D3A000-memory.dmp

Filesize
40KB

Download
memory/528-56-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/528-57-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/528-54-0x0000000001090000-0x00000000011BA000-memory.dmp

Filesize
1.2MB

Download
memory/528-55-0x0000000000ED0000-0x0000000000F10000-memory.dmp

Filesize
256KB

Download
memory/528-58-0x0000000000ED0000-0x0000000000F10000-memory.dmp

Filesize
256KB

Download
memory/528-216-0x0000000000ED0000-0x0000000000F10000-memory.dmp

Filesize
256KB

Download
memory/528-332-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/528-331-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/528-333-0x0000000000ED0000-0x0000000000F10000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing