Analysis
-
max time kernel
299s -
max time network
323s -
platform
windows10-1703_x64 -
resource
win10-20230220-es -
resource tags
-
submitted
02-04-2023 17:50
General
-
Target
Oneshot/LAUNCHER.exe
-
Size
227KB
-
MD5
d8a09db41481b0567601d2cab42db466
-
SHA1
ed0d1c96f7c81263643e2db9501d0c65477d7582
-
SHA256
3dad541c5fcdbc09b1c079e6c92837632c649d78084fdbab2bd2f1ce25ec2c5d
-
SHA512
f79daca8564f9cbcec59ceee458634fe223503b7eea6e2cf8f038fd3ef84044825a631f99872c732e3ae943531553510ff243c721478f3879ab818bf0b34b0c0
-
SSDEEP
3072:TGtleufyNONL4MdzCOY4jb1pQ2hHKPtOHO6VrVPoVJtCbhVPoVJtCbFyf:KtleuqKEYzYQyuHKPtOHRWehWeQ
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Oneshot\LAUNCHER.exe"C:\Users\Admin\AppData\Local\Temp\Oneshot\LAUNCHER.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Oneshot\steamshim.exe"C:\Users\Admin\AppData\Local\Temp\Oneshot\steamshim.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Oneshot\SmartSteamEmu.dll",InitSSE3⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Oneshot\oneshot.exe".\oneshot.exe"3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
488KB
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
136KB
-
Filesize
488KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
720KB
-
Filesize
1.3MB
-
Filesize
568KB
-
Filesize
496KB
-
Filesize
460KB
-
Filesize
236KB
-
Filesize
132KB
-
Filesize
768KB
-
Filesize
188KB
-
Filesize
136KB
-
Filesize
488KB
-
Filesize
5.6MB
-
Filesize
4.4MB
-
Filesize
4.5MB
-
Filesize
1.1MB
-
Filesize
1.4MB
-
Filesize
876KB
-
Filesize
148KB
-
Filesize
1.8MB
-
Filesize
2.6MB
-
Filesize
288KB
-
Filesize
264KB
-
Filesize
3.5MB
-
Filesize
1.1MB
-
Filesize
85.9MB
-
Filesize
3.2MB
-
Filesize
704KB
-
Filesize
1.1MB
-
Filesize
532KB
-
Filesize
1.1MB
-
Filesize
568KB
-
Filesize
496KB
-
Filesize
188KB
-
Filesize
460KB
-
Filesize
768KB
-
Filesize
236KB
-
Filesize
132KB
-
Filesize
136KB
-
Filesize
488KB
-
Filesize
5.6MB
-
Filesize
4.4MB
-
Filesize
4.5MB
-
Filesize
876KB
-
Filesize
1.1MB
-
Filesize
1.4MB
-
Filesize
460KB
-
Filesize
85.9MB
-
Filesize
148KB
-
Filesize
264KB
-
Filesize
720KB
-
Filesize
2.6MB
-
Filesize
1.8MB
-
Filesize
288KB
-
Filesize
3.5MB
-
Filesize
3.5MB