eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
152s
max time network
183s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
09-05-2023 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

trojan-leaks-main/ő (en).exe
Size

13.1MB
MD5

f281ea2b30b51ff08b9387382b2f5379
SHA1

ad54aeaeac284fa45d39805b2e465ec5f3346111
SHA256

0293181b3f8736138daa1b762a1d30bafb1731056ef19fdafa5fa6768601ce6f
SHA512

d5708ee42e78148e48b02bd60cceb6f8472457cd8cffe4bd66f35ec9fa122bfe9146331f395c5b679ee0586d9ffd1efce3979412e82934234859d98893d6b018
SSDEEP

393216:DRP9XCHT+X/A8chntmnTTxhuDoDpY2nbh9gwSI:9l6e4nnt6LuE1/dhSI

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 9 IoCs

Processes:

HeadFile.exeMBR.exenepovezlo.exeSound.exeErrorDraw.exeErrorDraw.exeRandButton.exePixels.exeGlitch3.exe

pid process

4052 HeadFile.exe
4716 MBR.exe
2416 nepovezlo.exe
1284 Sound.exe
4416 ErrorDraw.exe
4068 ErrorDraw.exe
4492 RandButton.exe
4288 Pixels.exe
4932 Glitch3.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

MBR.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MBR.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

4396 taskkill.exe
4300 taskkill.exe

pid	process
4052	HeadFile.exe
4716	MBR.exe
2416	nepovezlo.exe
1284	Sound.exe
4416	ErrorDraw.exe
4068	ErrorDraw.exe
4492	RandButton.exe
4288	Pixels.exe
4932	Glitch3.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MBR.exe

pid	process
4396	taskkill.exe
4300	taskkill.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXEtaskkill.exetaskkill.exe

description	pid	process
Token: 33	4568	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4568	AUDIODG.EXE
Token: SeDebugPrivilege	4396	taskkill.exe
Token: SeDebugPrivilege	4300	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

nepovezlo.exe

pid process

2416 nepovezlo.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

nepovezlo.exe

pid	process
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe
2416	nepovezlo.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

ő (en).exeHeadFile.exe

description	pid	process	target process
PID 4112 wrote to memory of 4052	4112	ő (en).exe	HeadFile.exe
PID 4112 wrote to memory of 4052	4112	ő (en).exe	HeadFile.exe
PID 4112 wrote to memory of 4052	4112	ő (en).exe	HeadFile.exe
PID 4052 wrote to memory of 4716	4052	HeadFile.exe	MBR.exe
PID 4052 wrote to memory of 4716	4052	HeadFile.exe	MBR.exe
PID 4052 wrote to memory of 4716	4052	HeadFile.exe	MBR.exe
PID 4052 wrote to memory of 2416	4052	HeadFile.exe	nepovezlo.exe
PID 4052 wrote to memory of 2416	4052	HeadFile.exe	nepovezlo.exe
PID 4052 wrote to memory of 2416	4052	HeadFile.exe	nepovezlo.exe
PID 4052 wrote to memory of 1284	4052	HeadFile.exe	Sound.exe
PID 4052 wrote to memory of 1284	4052	HeadFile.exe	Sound.exe
PID 4052 wrote to memory of 1284	4052	HeadFile.exe	Sound.exe
PID 4052 wrote to memory of 4416	4052	HeadFile.exe	ErrorDraw.exe
PID 4052 wrote to memory of 4416	4052	HeadFile.exe	ErrorDraw.exe
PID 4052 wrote to memory of 4416	4052	HeadFile.exe	ErrorDraw.exe
PID 4052 wrote to memory of 4068	4052	HeadFile.exe	ErrorDraw.exe
PID 4052 wrote to memory of 4068	4052	HeadFile.exe	ErrorDraw.exe
PID 4052 wrote to memory of 4068	4052	HeadFile.exe	ErrorDraw.exe
PID 4052 wrote to memory of 4492	4052	HeadFile.exe	RandButton.exe
PID 4052 wrote to memory of 4492	4052	HeadFile.exe	RandButton.exe
PID 4052 wrote to memory of 4492	4052	HeadFile.exe	RandButton.exe
PID 4052 wrote to memory of 4288	4052	HeadFile.exe	Pixels.exe
PID 4052 wrote to memory of 4288	4052	HeadFile.exe	Pixels.exe
PID 4052 wrote to memory of 4288	4052	HeadFile.exe	Pixels.exe
PID 4052 wrote to memory of 4396	4052	HeadFile.exe	taskkill.exe
PID 4052 wrote to memory of 4396	4052	HeadFile.exe	taskkill.exe
PID 4052 wrote to memory of 4396	4052	HeadFile.exe	taskkill.exe
PID 4052 wrote to memory of 4300	4052	HeadFile.exe	taskkill.exe
PID 4052 wrote to memory of 4300	4052	HeadFile.exe	taskkill.exe
PID 4052 wrote to memory of 4300	4052	HeadFile.exe	taskkill.exe
PID 4052 wrote to memory of 4932	4052	HeadFile.exe	Glitch3.exe
PID 4052 wrote to memory of 4932	4052	HeadFile.exe	Glitch3.exe
PID 4052 wrote to memory of 4932	4052	HeadFile.exe	Glitch3.exe

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\ő (en).exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\ő (en).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4112

C:\Users\Admin\AppData\Local\Temp\RarSFX0\HeadFile.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\HeadFile.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052

C:\Users\Admin\AppData\Local\Temp\RarSFX0\MBR.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\MBR.exe"
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4716

C:\Users\Admin\AppData\Local\Temp\RarSFX0\nepovezlo.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\nepovezlo.exe"
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2416

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Sound.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Sound.exe"
3⤵
- Executes dropped EXE
PID:1284

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ErrorDraw.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\ErrorDraw.exe"
3⤵
- Executes dropped EXE
PID:4416

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ErrorDraw.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\ErrorDraw.exe"
3⤵
- Executes dropped EXE
PID:4068

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RandButton.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\RandButton.exe"
3⤵
- Executes dropped EXE
PID:4492

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pixels.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pixels.exe"
3⤵
- Executes dropped EXE
PID:4288

C:\Windows\SysWOW64\taskkill.exe
taskkill.exe /F /IM Pixels.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4396

C:\Windows\SysWOW64\taskkill.exe
C:\Windows\System32\taskkill.exe /F /IM Pixels.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch3.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch3.exe"
3⤵
- Executes dropped EXE
PID:4932

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x398
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ErrorDraw.exe
Filesize
50KB

MD5
a33738d657aee7723671f84ccc528337

SHA1
ffe321129e9337233124f08458ff8b43401b33ae

SHA256
2791ee8466397f7bd025a992245eb0ad470835dba158a019cc9e5cd151d167cb

SHA512
2eefe11a2ce30486a1c356fcd172754624e39a89b3687370258b48d2bf8e805100b9990635d742141d2a51fb7fcb3da70521e548071547348fd251226433fcbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ErrorDraw.exe
Filesize
50KB

MD5
a33738d657aee7723671f84ccc528337

SHA1
ffe321129e9337233124f08458ff8b43401b33ae

SHA256
2791ee8466397f7bd025a992245eb0ad470835dba158a019cc9e5cd151d167cb

SHA512
2eefe11a2ce30486a1c356fcd172754624e39a89b3687370258b48d2bf8e805100b9990635d742141d2a51fb7fcb3da70521e548071547348fd251226433fcbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ErrorDraw.exe
Filesize
50KB

MD5
a33738d657aee7723671f84ccc528337

SHA1
ffe321129e9337233124f08458ff8b43401b33ae

SHA256
2791ee8466397f7bd025a992245eb0ad470835dba158a019cc9e5cd151d167cb

SHA512
2eefe11a2ce30486a1c356fcd172754624e39a89b3687370258b48d2bf8e805100b9990635d742141d2a51fb7fcb3da70521e548071547348fd251226433fcbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch3.exe
Filesize
50KB

MD5
46ef36a6d2993e839dddcc6976105350

SHA1
8adf8fb1348b8fc14bf434e33604d21e5648ce8d

SHA256
35db60d597e047793d24db554885671258f5684e7b6816ddc9cbdf153e1502fa

SHA512
119322ff3c4327c84e02181297b708ce56552001193aae8caef6b9c93eaad3c35752720f1e06df483e889ef675d6859b6b957de86ba243dc408b7629194f876f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch3.exe
Filesize
50KB

MD5
46ef36a6d2993e839dddcc6976105350

SHA1
8adf8fb1348b8fc14bf434e33604d21e5648ce8d

SHA256
35db60d597e047793d24db554885671258f5684e7b6816ddc9cbdf153e1502fa

SHA512
119322ff3c4327c84e02181297b708ce56552001193aae8caef6b9c93eaad3c35752720f1e06df483e889ef675d6859b6b957de86ba243dc408b7629194f876f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\HeadFile.exe
Filesize
360KB

MD5
aab8e05f4df037cffc1b9e3412fe277b

SHA1
4add73001060c13b3188fd9becc8b4607e451749

SHA256
1bea1f9ac11ccdf79cfd98003b6a9be5ce232d8fce18986d891ab67ca796e183

SHA512
abc8f71c1732945b9145993900a2b33d26c0d712eb17182bb76678db34d6ee3c344341d65114454dcc727b51a8af618785d50ecce7e4a0c31a1bdd3ac5b4bf06

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\HeadFile.exe
Filesize
360KB

MD5
aab8e05f4df037cffc1b9e3412fe277b

SHA1
4add73001060c13b3188fd9becc8b4607e451749

SHA256
1bea1f9ac11ccdf79cfd98003b6a9be5ce232d8fce18986d891ab67ca796e183

SHA512
abc8f71c1732945b9145993900a2b33d26c0d712eb17182bb76678db34d6ee3c344341d65114454dcc727b51a8af618785d50ecce7e4a0c31a1bdd3ac5b4bf06

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\MBR.exe
Filesize
48KB

MD5
f13248b7d74e5c344170aa70e16470a3

SHA1
c08fe5cb43b0b8477f27bce022c3aad63278b42a

SHA256
c1c12b39151120565f3f4212064cae26c4cc65970bdeefed370cb2fc1c3a4bb4

SHA512
c518f10a40d3393582933c4bcd80e78354116b82f2a819717214261841aea057fe797ed0f9c2d180b21cf876cff4b4603158ffc3120ee440a6274c925f07c817

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\MBR.exe
Filesize
48KB

MD5
f13248b7d74e5c344170aa70e16470a3

SHA1
c08fe5cb43b0b8477f27bce022c3aad63278b42a

SHA256
c1c12b39151120565f3f4212064cae26c4cc65970bdeefed370cb2fc1c3a4bb4

SHA512
c518f10a40d3393582933c4bcd80e78354116b82f2a819717214261841aea057fe797ed0f9c2d180b21cf876cff4b4603158ffc3120ee440a6274c925f07c817

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pixels.exe
Filesize
57KB

MD5
ea100daa0f7d4a46853304836025e434

SHA1
d6d5410f886edfdee94cd0cb711ea751dacf168a

SHA256
dd3585de3eb2bece737cd0766617cd412a3c63e2dd1e9f25b75e25750992b715

SHA512
af506bcbbe033b00362f8ab2751a1617129b01353a05ce0eb320efba81167d9a98a709dbe8497301e3fa055c4ee433c3f854c8adad4a7968e609f7a3ae4ffe5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pixels.exe
Filesize
57KB

MD5
ea100daa0f7d4a46853304836025e434

SHA1
d6d5410f886edfdee94cd0cb711ea751dacf168a

SHA256
dd3585de3eb2bece737cd0766617cd412a3c63e2dd1e9f25b75e25750992b715

SHA512
af506bcbbe033b00362f8ab2751a1617129b01353a05ce0eb320efba81167d9a98a709dbe8497301e3fa055c4ee433c3f854c8adad4a7968e609f7a3ae4ffe5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\RandButton.exe
Filesize
359KB

MD5
9f7bd2ef2de05cd3cba7a66068876516

SHA1
39d6881b841dda047e1d5457bf727a7fe080e7c0

SHA256
152104e3dbecee575acd5358b48679713a4b18a913a005249d074f312d3afb0d

SHA512
9c2241ace19770f228be1386488b4994ae32d42bd50cf394ea8bf8716cc2f42394d6e7cf32c9960be64d8f5812014194ae3d24d55a1a9ddc22fa74cf823c83c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\RandButton.exe
Filesize
359KB

MD5
9f7bd2ef2de05cd3cba7a66068876516

SHA1
39d6881b841dda047e1d5457bf727a7fe080e7c0

SHA256
152104e3dbecee575acd5358b48679713a4b18a913a005249d074f312d3afb0d

SHA512
9c2241ace19770f228be1386488b4994ae32d42bd50cf394ea8bf8716cc2f42394d6e7cf32c9960be64d8f5812014194ae3d24d55a1a9ddc22fa74cf823c83c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Sound.exe
Filesize
359KB

MD5
5a8d72063530284c2341b1a05d9604c7

SHA1
9f665c9ac191b2afbefe47b63b8343ff965f7288

SHA256
2cc3da35bc5fd89ed1214f34094d2c6b98ea105ee525d454f6d8d16657f1acac

SHA512
6e152c351ef55d53f47d4077199557ab1256cc883450a039940ae2864f28ec2aa114afae272af1192a3e4df607560d2f5a8954765cc5ff54ea57e1284be6ff87

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Sound.exe
Filesize
359KB

MD5
5a8d72063530284c2341b1a05d9604c7

SHA1
9f665c9ac191b2afbefe47b63b8343ff965f7288

SHA256
2cc3da35bc5fd89ed1214f34094d2c6b98ea105ee525d454f6d8d16657f1acac

SHA512
6e152c351ef55d53f47d4077199557ab1256cc883450a039940ae2864f28ec2aa114afae272af1192a3e4df607560d2f5a8954765cc5ff54ea57e1284be6ff87

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\gl.wav
Filesize
14.8MB

MD5
ed830af08f72d0156d7efcbb8668cdd7

SHA1
3ef480a6ff07416835143b50706351dcd3d4a2ca

SHA256
583fe6351dfeccacd769b4a67a573b010a44cd3523f51ce7ee6f0c51e5853086

SHA512
b8730e156e1eb2a87cea51722be5aaf6b98759ae061bb328c4bb5c076011d4cb89351dbea989d010cf45f0021126af76611b086b9bb9bea67041f8bbe40c3ffc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\nepovezlo.exe
Filesize
700KB

MD5
7b8d687cbcc6880438923266283bba37

SHA1
9dd61cd56101b7f810f6c65d0e27922539580123

SHA256
e47d9f227d4637d10482072f28843d32fb8c9ce061f4a1a5636dfdaefedc81aa

SHA512
0ab314fdc880bcf575818c42d65b9fcfa3a94813b254a859594dcad3602a35f7a5a41a50b06f71d889092027da87fe220c485766a90936876f3b243c623ecfcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\nepovezlo.exe
Filesize
700KB

MD5
7b8d687cbcc6880438923266283bba37

SHA1
9dd61cd56101b7f810f6c65d0e27922539580123

SHA256
e47d9f227d4637d10482072f28843d32fb8c9ce061f4a1a5636dfdaefedc81aa

SHA512
0ab314fdc880bcf575818c42d65b9fcfa3a94813b254a859594dcad3602a35f7a5a41a50b06f71d889092027da87fe220c485766a90936876f3b243c623ecfcf

Download Submit
memory/1284-166-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/1284-168-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4052-149-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/4052-153-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4068-185-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4288-196-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4416-180-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4492-186-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4492-193-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4492-181-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/4492-201-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4492-206-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4716-152-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4932-207-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download