8c5002e3b88f478d1420de7cabec2363b0c104920d0e45c1a090537ba4aaccb1

General

Target

8c5002e3b88f478d1420de7cabec2363b0c104920d0e45c1a090537ba4aaccb1.dll
Size

5.0MB
MD5

4715cea773f5968b3bc71865bd2d75f2
SHA1

cccf459bb10ac4b90ddb87436245d927b657ce8e
SHA256

8c5002e3b88f478d1420de7cabec2363b0c104920d0e45c1a090537ba4aaccb1
SHA512

cef4cc50e013d97d496b68aaddc7d9fce076805bb4074fd008a976ab292ce19147aec88736fd7ee17482d50fc0d297eba738bfa2a2ca2e949f924dd0150fa047
SSDEEP

98304:Xapmrmc2lAu88lkcf5YjovKqGYiOE8oLj5kI4rRev+3:XzmZlq5gyjovK65E8obHW3

Score

8^/10

bootkit persistence

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

3 1424 rundll32.exe
4 1424 rundll32.exe
7 1424 rundll32.exe
9 1424 rundll32.exe
Loads dropped DLL 3 IoCs

Processes:

rundll32.exe

pid process

1424 rundll32.exe
1424 rundll32.exe
1424 rundll32.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
3	1424	rundll32.exe
4	1424	rundll32.exe
7	1424	rundll32.exe
9	1424	rundll32.exe

pid	process
1424	rundll32.exe
1424	rundll32.exe
1424	rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1260 wrote to memory of 1424	1260	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1424	1260	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1424	1260	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1424	1260	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1424	1260	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1424	1260	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1424	1260	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c5002e3b88f478d1420de7cabec2363b0c104920d0e45c1a090537ba4aaccb1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c5002e3b88f478d1420de7cabec2363b0c104920d0e45c1a090537ba4aaccb1.dll,#1
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:1424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\LDSGameMaster\Store\360Base.dll
Filesize
862KB

MD5
ab00bed7cb2b7a8290e247fc34aaa5ff

SHA1
d6014e2920d9b587a8e12ae1ba0f1e1fc9edffa8

SHA256
ceffaedc050688e8dcc11ec30b703c63fefbfcf479558604fdb0ea42bcb497c0

SHA512
fbe3bf5e142d689bb15d05503fcf5c807aad5bcb99a02dc99590589ee66f7942a0d8365d470041972212dbdf9c232ab4bbab25e79d7bcd43f001a95d9012cca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFOBZ3YS\mgame[1].txt
Filesize
2B

MD5
444bcb3a3fcf8389296c49467f27e1d6

SHA1
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb

SHA256
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

SHA512
9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5F7A1D5A-B1C6-43d0-B40C-1F05723893E2}.tmp\360NetUL.dll
Filesize
234KB

MD5
cd03029957ebc78c0ca7a6c02a9ca846

SHA1
0044114b8073781479044f0294701be9611be2ac

SHA256
139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048

SHA512
14c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5F7A1D5A-B1C6-43d0-B40C-1F05723893E2}.tmp\NetBridge.dll
Filesize
238KB

MD5
8786d469338c30e0ba9fedfc62bd5197

SHA1
5fb12028ceae9772f938e1b98b699f0e02e32718

SHA256
beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f

SHA512
5db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5F7A1D5A-B1C6-43d0-B40C-1F05723893E2}.tmp\Utils\LDSBasic.dll
Filesize
2.1MB

MD5
c35ab236702291f1a2d090af8ea253d9

SHA1
d7f58f0f5fee6b26564af3c5d7ab6defe5a4608d

SHA256
c4dba892a9a1fb675d06dd615c4fc079e9f4e12a8368e8bd18e37137ed567f35

SHA512
87a3fa1927ad2fad117055411a471be95275a4d4bf99ee3ab522faee70067b239bb77ddd94c4300958607efd4a3fc071df2262754557fca2530e70f2c438a068

Download Submit
\Users\Admin\AppData\Local\Temp\{5F7A1D5A-B1C6-43d0-B40C-1F05723893E2}.tmp\360NetUL.dll
Filesize
234KB

MD5
cd03029957ebc78c0ca7a6c02a9ca846

SHA1
0044114b8073781479044f0294701be9611be2ac

SHA256
139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048

SHA512
14c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32

Download Submit
\Users\Admin\AppData\Local\Temp\{5F7A1D5A-B1C6-43d0-B40C-1F05723893E2}.tmp\Utils\LDSBasic.dll
Filesize
2.1MB

MD5
c35ab236702291f1a2d090af8ea253d9

SHA1
d7f58f0f5fee6b26564af3c5d7ab6defe5a4608d

SHA256
c4dba892a9a1fb675d06dd615c4fc079e9f4e12a8368e8bd18e37137ed567f35

SHA512
87a3fa1927ad2fad117055411a471be95275a4d4bf99ee3ab522faee70067b239bb77ddd94c4300958607efd4a3fc071df2262754557fca2530e70f2c438a068

Download Submit
\Users\Admin\AppData\Local\Temp\{98137B0B-BE89-414f-9137-A61994FDDF2E}.tmp\7z.dll
Filesize
1.1MB

MD5
a46135bdd574092d85955070e72d5aad

SHA1
aad137b0a883fea22b7118778512ffc7865513bc

SHA256
aa57160684feb240a85da677caaf7cf6a08b7349d89ae9cb4a3476884d80aac5

SHA512
72188f348d9ae33e2b5a7886c80667cc3015bfac170249537baa9e31abf8d63ca198903206feb64887f1d509a1b9bfc9f54ede8b3aa26bee3f5c4375e5c6a24b

Download Submit
memory/1424-93-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing