c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062

Analysis

max time kernel
106s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2023 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
Size

26.1MB
MD5

adaec1033cf74bc93f813c119eb835e6
SHA1

5627c51939e3bf2055c45fa1a1036c52e9b2c32f
SHA256

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062
SHA512

7f4758dc8ec7990f23a1eccca3165b1b3bd46a06a6d7c3e35d78ff2aad525e93928defd37ceb07fb6915fcb130e66da5d76b93e5306405fccc5286e6eeae111b
SSDEEP

786432:Y0RjWCY4UU/QMjvvoyktUEQmUaZcu0J/+K98TJA:Y0hWCuU9jvQysUnmUaZcN/+KCG

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 13 IoCs

Processes:

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

pid	process
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ip-api.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

description ioc process

File opened for modification \??\PhysicalDrive0 c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
7	ip-api.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

TASKKILL.exeTASKKILL.exe

pid process

224 TASKKILL.exe
4704 TASKKILL.exe

pid	process
224	TASKKILL.exe
4704	TASKKILL.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

pid	process
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

TASKKILL.exeTASKKILL.exe

description pid process

Token: SeDebugPrivilege 224 TASKKILL.exe
Token: SeDebugPrivilege 4704 TASKKILL.exe

description	pid	process
Token: SeDebugPrivilege	224	TASKKILL.exe
Token: SeDebugPrivilege	4704	TASKKILL.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe

description	pid	process	target process
PID 2108 wrote to memory of 224	2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe
PID 2108 wrote to memory of 224	2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe
PID 2108 wrote to memory of 224	2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe
PID 2108 wrote to memory of 4704	2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe
PID 2108 wrote to memory of 4704	2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe
PID 2108 wrote to memory of 4704	2108	c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe	TASKKILL.exe

C:\Users\Admin\AppData\Local\Temp\c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe
"C:\Users\Admin\AppData\Local\Temp\c2dc418fce61034bb32db191b1b8ee54db2b082cbaff3c38145f1413b9832062.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\TASKKILL.exe
"TASKKILL " /F /IM TurboVPN.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:224

C:\Windows\SysWOW64\TASKKILL.exe
"TASKKILL " /F /IM turboconfig.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\FindProcDLL.dll
Filesize
27KB

MD5
6f73b00aef6c49eac62128ef3eca677e

SHA1
1b6aff67d570e5ee61af2376247590eb49b728a1

SHA256
6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9

SHA512
678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\InstallOptions.dll
Filesize
15KB

MD5
09d8971beefefffd710030dd167a99e0

SHA1
a0117786ad77213f3eb48cfdc3819786cb796b7d

SHA256
caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95

SHA512
3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\InstallOptions.dll
Filesize
15KB

MD5
09d8971beefefffd710030dd167a99e0

SHA1
a0117786ad77213f3eb48cfdc3819786cb796b7d

SHA256
caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95

SHA512
3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\InstallOptions.dll
Filesize
15KB

MD5
09d8971beefefffd710030dd167a99e0

SHA1
a0117786ad77213f3eb48cfdc3819786cb796b7d

SHA256
caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95

SHA512
3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\ioSpecial.ini
Filesize
1KB

MD5
6ddec9c543e3bc9199875dff55605065

SHA1
bdefb2c26bc729ebbd2120357071d8a344600c35

SHA256
3d2c98486a936f27920c92e3f6577d8ec7456b1bb7bfde0ba5908483d8a7c993

SHA512
a1e05961861440a17aede18a33898dbb3672971e76d6632459572db36abd55acbc8f4dac8befeec5862dacccb2f4e6cfb187c81cab53c7af266641b957b92e7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\myinternet.dll
Filesize
1.2MB

MD5
b29b3e3874823b17c11ee5dfca740c72

SHA1
1e104c9a9bbae8437127ed8ff691c2d33047e4c2

SHA256
2b90122ac9259751de7e257e61292966d649a021ba91769e7496a38cafec5f47

SHA512
07ed39976dc7e0b8e3d4a6370ec731901caa6ed7e06709ea80d3eb27b92a1103c7bdec03e4c89873bbd8f2339ab88425fe46aaa05b20cce6780f603654cf48fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\nsExec.dll
Filesize
7KB

MD5
f27689c513e7d12c7c974d5f8ef710d6

SHA1
e305f2a2898d765a64c82c449dfb528665b4a892

SHA256
1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47

SHA512
734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\nsExec.dll
Filesize
7KB

MD5
f27689c513e7d12c7c974d5f8ef710d6

SHA1
e305f2a2898d765a64c82c449dfb528665b4a892

SHA256
1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47

SHA512
734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\nsExec.dll
Filesize
7KB

MD5
f27689c513e7d12c7c974d5f8ef710d6

SHA1
e305f2a2898d765a64c82c449dfb528665b4a892

SHA256
1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47

SHA512
734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDCAA.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit