c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062

Analysis

max time kernel
133s
max time network
73s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03-04-2023 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
Size

26.1MB
MD5

adaec1033cf74bc93f813c119eb835e6
SHA1

5627c51939e3bf2055c45fa1a1036c52e9b2c32f
SHA256

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062
SHA512

7f4758dc8ec7990f23a1eccca3165b1b3bd46a06a6d7c3e35d78ff2aad525e93928defd37ceb07fb6915fcb130e66da5d76b93e5306405fccc5286e6eeae111b
SSDEEP

786432:Y0RjWCY4UU/QMjvvoyktUEQmUaZcu0J/+K98TJA:Y0hWCuU9jvQysUnmUaZcN/+KCG

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 13 IoCs

Processes:

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

pid	process
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

description ioc process

File opened for modification \??\PhysicalDrive0 c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
1	ip-api.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

TASKKILL.exeTASKKILL.exe

pid process

272 TASKKILL.exe
1112 TASKKILL.exe

pid	process
272	TASKKILL.exe
1112	TASKKILL.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

pid	process
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

pid process

1992 c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

TASKKILL.exeTASKKILL.exe

description pid process

Token: SeDebugPrivilege 272 TASKKILL.exe
Token: SeDebugPrivilege 1112 TASKKILL.exe

description	pid	process
Token: SeDebugPrivilege	272	TASKKILL.exe
Token: SeDebugPrivilege	1112	TASKKILL.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

description	pid	process	target process
PID 1992 wrote to memory of 272	1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe
PID 1992 wrote to memory of 272	1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe
PID 1992 wrote to memory of 272	1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe
PID 1992 wrote to memory of 272	1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe
PID 1992 wrote to memory of 1112	1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe
PID 1992 wrote to memory of 1112	1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe
PID 1992 wrote to memory of 1112	1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe
PID 1992 wrote to memory of 1112	1992	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe

C:\Users\Admin\AppData\Local\Temp\c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
"C:\Users\Admin\AppData\Local\Temp\c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\TASKKILL.exe
"TASKKILL " /F /IM TurboVPN.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:272

C:\Windows\SysWOW64\TASKKILL.exe
"TASKKILL " /F /IM turboconfig.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\InstallOptions.dll
Filesize
15KB

MD5
09d8971beefefffd710030dd167a99e0

SHA1
a0117786ad77213f3eb48cfdc3819786cb796b7d

SHA256
caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95

SHA512
3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\ioSpecial.ini
Filesize
1KB

MD5
aa9b632338e7ddd22dd4c97568a968b9

SHA1
3a143dea517b1ae04ee70941fd28c476dbed8d3f

SHA256
288f9736a9e543c240707f3aa597e2c582613e6e24691a8c3178889f1e78e193

SHA512
10a68ec902b1777e7aad784f7e46fc17aa67cc7a6ac159f3484853fd4e902b6e36418b7607ab3b161a01765ce281b841070a1f3be6a42fdf20c24927f53b8016

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\ioSpecial.ini
Filesize
1KB

MD5
b3951c2105b808292cf049dc61f6ca93

SHA1
e12681c0e720ee24c995551c1bf25672449e80a6

SHA256
5b257c92afbb3cd74d3c52ad64f23d1823174bb2a218c0a0c17509d959830259

SHA512
0ab3b5e0ee26065ceafaeb39addcab95dcfaf04eafd45b039980084fab289ff1f2271b6910f50b9882c6942cbd756369dfd3ea628bd63fa1a1885316a023ee50

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\myinternet.dll
Filesize
1.2MB

MD5
b29b3e3874823b17c11ee5dfca740c72

SHA1
1e104c9a9bbae8437127ed8ff691c2d33047e4c2

SHA256
2b90122ac9259751de7e257e61292966d649a021ba91769e7496a38cafec5f47

SHA512
07ed39976dc7e0b8e3d4a6370ec731901caa6ed7e06709ea80d3eb27b92a1103c7bdec03e4c89873bbd8f2339ab88425fe46aaa05b20cce6780f603654cf48fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\nsExec.dll
Filesize
7KB

MD5
f27689c513e7d12c7c974d5f8ef710d6

SHA1
e305f2a2898d765a64c82c449dfb528665b4a892

SHA256
1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47

SHA512
734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\FindProcDLL.dll
Filesize
27KB

MD5
6f73b00aef6c49eac62128ef3eca677e

SHA1
1b6aff67d570e5ee61af2376247590eb49b728a1

SHA256
6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9

SHA512
678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\InstallOptions.dll
Filesize
15KB

MD5
09d8971beefefffd710030dd167a99e0

SHA1
a0117786ad77213f3eb48cfdc3819786cb796b7d

SHA256
caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95

SHA512
3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\InstallOptions.dll
Filesize
15KB

MD5
09d8971beefefffd710030dd167a99e0

SHA1
a0117786ad77213f3eb48cfdc3819786cb796b7d

SHA256
caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95

SHA512
3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\myinternet.dll
Filesize
1.2MB

MD5
b29b3e3874823b17c11ee5dfca740c72

SHA1
1e104c9a9bbae8437127ed8ff691c2d33047e4c2

SHA256
2b90122ac9259751de7e257e61292966d649a021ba91769e7496a38cafec5f47

SHA512
07ed39976dc7e0b8e3d4a6370ec731901caa6ed7e06709ea80d3eb27b92a1103c7bdec03e4c89873bbd8f2339ab88425fe46aaa05b20cce6780f603654cf48fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\nsExec.dll
Filesize
7KB

MD5
f27689c513e7d12c7c974d5f8ef710d6

SHA1
e305f2a2898d765a64c82c449dfb528665b4a892

SHA256
1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47

SHA512
734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\nsExec.dll
Filesize
7KB

MD5
f27689c513e7d12c7c974d5f8ef710d6

SHA1
e305f2a2898d765a64c82c449dfb528665b4a892

SHA256
1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47

SHA512
734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsj28B8.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit