6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c

General

Target

6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c.exe
Size

20.9MB
MD5

caaa8a8775425f0157c21e5dbad52ab3
SHA1

284c3a5547de98e75359c9c1e51375ab443d5d89
SHA256

6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c
SHA512

7fe8251f16b78bc21bbe39c7e7e4526cb036558745f6435c9ad438b6c23239bbafa9e5496b2d383b708122c01e131b3ceda158ac70e2ccead0ce926e3b4250ec
SSDEEP

393216:ulD99jOVfkG7jhjxf5t5w6Y/tyD0VzPk2ck5ucrvbwGIz2wefkpo7U8KXy:A4Vfk8hjxf5IjE9CrvbwHgsy91

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1496	6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c.exe
1496	6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c.exe
1496	6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c.exe
1496	6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1496-75-0x0000000000400000-0x00000000005E0000-memory.dmp	upx
behavioral1/memory/1496-159-0x0000000000400000-0x00000000005E0000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nst3B40.tmp.SogouPY_.ime	6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c.exe
File opened for modification	C:\Windows\SysWOW64\nst3B40.tmp.SogouPY_.ime	6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1496	6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1496	6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c.exe

C:\Users\Admin\AppData\Local\Temp\6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c.exe
"C:\Users\Admin\AppData\Local\Temp\6416fed720d4d04943e4f0de392e69cd6576c29f674fd7647864938a214c7f4c.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso394C.tmp\SetupLib.dll

Filesize
251KB

MD5
05b430c0ee0f612173f8630c0ff416d6

SHA1
2d3cc6f6191899a6b036911b88aee7644db61961

SHA256
2448faf59ed28c5d0630f440c33cab9f57acd378192a027d98a86e0cc2f559e4

SHA512
24031499b52163fdef9fd4385cdeef305cea3210f3082ba1b1398261dc1e1456fcc30643baf643a0035c678fad5226fce63e796a6b76ce3044f9f737c513f1e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso394C.tmp\ioSpecial.ini

Filesize
954B

MD5
d3491a07750536b5234a136b8a4b1043

SHA1
a3bea12ee3e93e845428a195452be587e7ab30e8

SHA256
154bca1d1f145b2676fe8569e816e3bfb6d6b03a5f1b1704ef4163fc0b23b6fd

SHA512
9131dc0fb9887a28476033ee271cc755f21542b3ab21efbae3c77bbcbe9457c41ae52c42811a20e1777bd76536f8494934a2a93efb31bea90cc512279e4b66be

Download Submit
\Users\Admin\AppData\Local\Temp\nso394C.tmp\HWSignature.dll

Filesize
70KB

MD5
4fec8eb7dec1ff234acd3070d2afeedc

SHA1
8dba3681158f22bd03229d8191e4385a97b0fbe5

SHA256
5b244f10ec9c28015d599d613b580d576824f4bd1f7572e18c0ffdbeba7e65d1

SHA512
26f36b6a01ba39695c907b1adefbf6157100a0aa4edacc9931823c63c601e12afb254612f906e0efa5256a001902e938d29ba5c18b932dfddb90293eb1561f4d

Download Submit
\Users\Admin\AppData\Local\Temp\nso394C.tmp\InstallOptions.dll

Filesize
15KB

MD5
6e663f1a0de94bc05d64d020da5d6f36

SHA1
c5abb0033776d6ab1f07e5b3568f7d64f90e5b04

SHA256
458b70e1745dc6e768d2338ccf3e6e86436488954ca3763472d8ffec4e7177e4

SHA512
2a037c39f3a08d4a80494227990f36c4fef2f73c4a6ad74dcc334317a1372234c25d08d8b80d79e126881a49fa4b3f2fffe3604c959d9ceceb47acc7192cc6a5

Download Submit
\Users\Admin\AppData\Local\Temp\nso394C.tmp\SetupLib.dll

Filesize
251KB

MD5
05b430c0ee0f612173f8630c0ff416d6

SHA1
2d3cc6f6191899a6b036911b88aee7644db61961

SHA256
2448faf59ed28c5d0630f440c33cab9f57acd378192a027d98a86e0cc2f559e4

SHA512
24031499b52163fdef9fd4385cdeef305cea3210f3082ba1b1398261dc1e1456fcc30643baf643a0035c678fad5226fce63e796a6b76ce3044f9f737c513f1e6

Download Submit
\Users\Admin\AppData\Local\Temp\nso394C.tmp\System.dll

Filesize
11KB

MD5
b9f430f71c7144d8ff4ab94be2785aa6

SHA1
c5c1e153caff7ad1d221a9acc8bbb831f05ccb05

SHA256
b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655

SHA512
c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099

Download Submit
memory/1496-64-0x00000000003A0000-0x00000000003E3000-memory.dmp

Filesize
268KB

Download
memory/1496-69-0x00000000006C0000-0x00000000006D6000-memory.dmp

Filesize
88KB

Download
memory/1496-75-0x0000000000400000-0x00000000005E0000-memory.dmp

Filesize
1.9MB

Download
memory/1496-159-0x0000000000400000-0x00000000005E0000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing