2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2023 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
Size

26.0MB
MD5

b700c077b7e996a9024790647fdf3ada
SHA1

dbc34258628fb122e4bfd7f1d845af4f340665e0
SHA256

2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86
SHA512

82e7d4b798464ff18ed12687064956b457b0596d3fc3fc067e57c62429d877b3808b8c95e7eea8367f1721b845c99e015f01543c9a090c0ce9ba27b86371c46f
SSDEEP

786432:UjRaLwqLOUjqZNDRLPjqLBeYPWEiR4mEAnG4f3k:UjRakqaNLPmLMu7a/EA9M

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 12 IoCs

Processes:

2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe

pid	process
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe

description ioc process

File opened for modification \??\PhysicalDrive0 2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
8	ip-api.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

TASKKILL.exe

pid process

2228 TASKKILL.exe

pid	process
2228	TASKKILL.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe

pid	process
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

TASKKILL.exe

description pid process

Token: SeDebugPrivilege 2228 TASKKILL.exe

description	pid	process
Token: SeDebugPrivilege	2228	TASKKILL.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe

description	pid	process	target process
PID 1440 wrote to memory of 2228	1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe	TASKKILL.exe
PID 1440 wrote to memory of 2228	1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe	TASKKILL.exe
PID 1440 wrote to memory of 2228	1440	2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe	TASKKILL.exe

C:\Users\Admin\AppData\Local\Temp\2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe
"C:\Users\Admin\AppData\Local\Temp\2025e0f44f72db531750abe4efb27802a7ae3a0f742cc01c3a424b411b79ac86.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\TASKKILL.exe
"TASKKILL " /F /IM TurboVPN.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\FindProcDLL.dll
Filesize
27KB

MD5
6f73b00aef6c49eac62128ef3eca677e

SHA1
1b6aff67d570e5ee61af2376247590eb49b728a1

SHA256
6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9

SHA512
678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\InstallOptions.dll
Filesize
15KB

MD5
09d8971beefefffd710030dd167a99e0

SHA1
a0117786ad77213f3eb48cfdc3819786cb796b7d

SHA256
caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95

SHA512
3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\InstallOptions.dll
Filesize
15KB

MD5
09d8971beefefffd710030dd167a99e0

SHA1
a0117786ad77213f3eb48cfdc3819786cb796b7d

SHA256
caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95

SHA512
3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\InstallOptions.dll
Filesize
15KB

MD5
09d8971beefefffd710030dd167a99e0

SHA1
a0117786ad77213f3eb48cfdc3819786cb796b7d

SHA256
caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95

SHA512
3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\ioSpecial.ini
Filesize
1KB

MD5
aba1a657909fa0da19860468ef8239a1

SHA1
c8839927de5a3ed07433ba8c42afd1b832010b67

SHA256
6594d21b3b106d5fff28bb21c2c4cff0828908ceabe358f48c5443eb07c03776

SHA512
0e37831c7d566616479603490b9e9bf161840fd653e1b7a776017866bf78c2b81f19f741ea409c379819cdb22579df28439d6726bc700e6bb2c2c16be40f2417

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\myinternet.dll
Filesize
1.2MB

MD5
b29b3e3874823b17c11ee5dfca740c72

SHA1
1e104c9a9bbae8437127ed8ff691c2d33047e4c2

SHA256
2b90122ac9259751de7e257e61292966d649a021ba91769e7496a38cafec5f47

SHA512
07ed39976dc7e0b8e3d4a6370ec731901caa6ed7e06709ea80d3eb27b92a1103c7bdec03e4c89873bbd8f2339ab88425fe46aaa05b20cce6780f603654cf48fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\nsExec.dll
Filesize
7KB

MD5
f27689c513e7d12c7c974d5f8ef710d6

SHA1
e305f2a2898d765a64c82c449dfb528665b4a892

SHA256
1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47

SHA512
734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy69FB.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit