Resubmissions

09-05-2023 19:22

230509-x3fn4adg58 10

09-05-2023 19:14

230509-xxsrgaff7x 10

09-05-2023 19:14

230509-xxr5yadg42 7

09-05-2023 19:14

230509-xxrt6sff7w 8

09-05-2023 19:14

230509-xxrjeaff7v 8

09-05-2023 19:14

230509-xxqxwadg39 7

09-05-2023 19:14

230509-xxql4sff7t 10

09-05-2023 19:14

230509-xxqbcadg38 7

09-05-2023 19:10

230509-xvl6xadf64 10

Analysis

  • max time kernel
    262s
  • max time network
    410s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2023 19:14

General

  • Target

    trojan-leaks-main/dobrota/dobrota.exe

  • Size

    7.8MB

  • MD5

    1c33f964fbf5b3642d02e4b20ba6f2ac

  • SHA1

    dcec14364a4548ce394906487a37f98bb1d12198

  • SHA256

    10a45dc010df96cbd65bfd8a59e906ca5f98dd6f7541cf02bdfc17df8384bb8f

  • SHA512

    ea3268a85ff2dfe7c94c6eb670f4aa3a13ec3019cf47bbcfa7e31eaa48dea0c8ee7dd0ebd020785942063e8acee7e2df62cd0c1eadf46a0208ebea29e146462b

  • SSDEEP

    98304:Jqx1gyR0CwX6T036KJt6Oe2NhqCZao4+Axhy4V7FLEMUH82Z3dFRsFVsKtOep1eT:6WhwInbrIh17FFWZnR0VsAHndDNc7T

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\dobrota\dobrota.exe
    "C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\dobrota\dobrota.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\start_dobrota.bat" "
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:832
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\mbr.exe
        mbr.exe
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        PID:1056
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sound.vbs"
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:328
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazywarningicons.exe
        crazywarningicons.exe
        3⤵
        • Executes dropped EXE
        PID:1744
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazyinvers.exe
        crazyinvers.exe
        3⤵
        • Executes dropped EXE
        PID:2004
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\INVERS.exe
        INVERS.exe
        3⤵
        • Executes dropped EXE
        PID:1740
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\toonel.exe
        toonel.exe
        3⤵
        • Executes dropped EXE
        PID:1100
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exe
        erroriconscursor.exe
        3⤵
        • Executes dropped EXE
        PID:1824
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroricons.exe
        erroricons.exe
        3⤵
        • Executes dropped EXE
        PID:1392
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x520
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:908

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\INVERS.exe

    Filesize

    2.3MB

    MD5

    5134f289dbf4abae370e3f36b637b73e

    SHA1

    c78d3f2d00dc47da0112a74df665c7a84a8e32c3

    SHA256

    e69c9383b5d9fe4e069ddee15797c52e9116f883ad3b1717d2519621ab2751b2

    SHA512

    0bf61a04b93b1ba5b8a0e2d9a1c333cc4605350a4c797cc9f5f78fec698d6f4fd62d329513ed406e76a06aa6af0f00d206da723e5a33315ce8de7f68f2002cb5

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\INVERS.exe

    Filesize

    2.3MB

    MD5

    5134f289dbf4abae370e3f36b637b73e

    SHA1

    c78d3f2d00dc47da0112a74df665c7a84a8e32c3

    SHA256

    e69c9383b5d9fe4e069ddee15797c52e9116f883ad3b1717d2519621ab2751b2

    SHA512

    0bf61a04b93b1ba5b8a0e2d9a1c333cc4605350a4c797cc9f5f78fec698d6f4fd62d329513ed406e76a06aa6af0f00d206da723e5a33315ce8de7f68f2002cb5

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazyinvers.exe

    Filesize

    2.3MB

    MD5

    a44458813e819777013eb3e644d74362

    SHA1

    2dd0616ca78e22464cf0cf68ef7915358a16f9ee

    SHA256

    47f0e9a90d45b193e81d3e60b7a43e5a4550a07a3dd1f7c98110fde12265d999

    SHA512

    1a4723a36f55cf696f33a7927571bda403e81ced32fda85c7cf25c8458897fb187e46bf5f80c26542725a9a7e5aa0e961fd3f3b110ae8f54b3b96b3e5dfc8215

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazyinvers.exe

    Filesize

    2.3MB

    MD5

    a44458813e819777013eb3e644d74362

    SHA1

    2dd0616ca78e22464cf0cf68ef7915358a16f9ee

    SHA256

    47f0e9a90d45b193e81d3e60b7a43e5a4550a07a3dd1f7c98110fde12265d999

    SHA512

    1a4723a36f55cf696f33a7927571bda403e81ced32fda85c7cf25c8458897fb187e46bf5f80c26542725a9a7e5aa0e961fd3f3b110ae8f54b3b96b3e5dfc8215

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazywarningicons.exe

    Filesize

    1.2MB

    MD5

    e21bb4749a8b1b6fc26a7bcf57781836

    SHA1

    89cb0bd80d691ca650ad01551be3acefa2256ebd

    SHA256

    0ecbb8099ed1d9a1673165d3c4c9bbde88dd9678540a98b99434ff23b9e6d82c

    SHA512

    b0ccf421e415f94b6f0497dd041a8e7693d01d72cd577eca771d2049516f7a0c8c7221da642e5c38d5bc95a2335279d36f956314bda442b99a2d244bcc73b47b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazywarningicons.exe

    Filesize

    1.2MB

    MD5

    e21bb4749a8b1b6fc26a7bcf57781836

    SHA1

    89cb0bd80d691ca650ad01551be3acefa2256ebd

    SHA256

    0ecbb8099ed1d9a1673165d3c4c9bbde88dd9678540a98b99434ff23b9e6d82c

    SHA512

    b0ccf421e415f94b6f0497dd041a8e7693d01d72cd577eca771d2049516f7a0c8c7221da642e5c38d5bc95a2335279d36f956314bda442b99a2d244bcc73b47b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\dobrota.mp3

    Filesize

    6.6MB

    MD5

    fad2e8c2a096f4593a03a771bbe99458

    SHA1

    88af47f279b9ea008901a6a242466f40f44e8a5c

    SHA256

    a40dd9aedae52766593bce06a9a68d47fcf8d430f254ce5e50b0c55587d46213

    SHA512

    7b607d2927bfb5d2ae3da7ad40fc842f6c1cd12cbc8814a043950d65f50d8084aaa8a544fe51312e68bde9434b138c5c8df50568650658ed0600f447a4a32441

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroricons.exe

    Filesize

    316KB

    MD5

    7f31508d95be3fe50e4e9aa646e86a12

    SHA1

    c61b439d6e17d630728f48c09b36af2647940748

    SHA256

    994efdb644ca1acb029dfd8d8eeba440e1cb74d93841b17f21165b9900730b15

    SHA512

    2e2b01e84a3476b47a9c703b71ce31887e4a4fa9340780f0cbbd20601be621bf00b9619df8bec0e81b2825550150c477c5071d921104a4c6265ef2d5a9e77eda

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroricons.exe

    Filesize

    316KB

    MD5

    7f31508d95be3fe50e4e9aa646e86a12

    SHA1

    c61b439d6e17d630728f48c09b36af2647940748

    SHA256

    994efdb644ca1acb029dfd8d8eeba440e1cb74d93841b17f21165b9900730b15

    SHA512

    2e2b01e84a3476b47a9c703b71ce31887e4a4fa9340780f0cbbd20601be621bf00b9619df8bec0e81b2825550150c477c5071d921104a4c6265ef2d5a9e77eda

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exe

    Filesize

    316KB

    MD5

    135eeb256e92d261066cfd3ffd31fb3e

    SHA1

    5c275ffd2ab1359249bae8c91bebcab19a185e91

    SHA256

    f0fe346146c30129ed6f507906c973f1a54c7d8dd8821c97e9b6edc42545699d

    SHA512

    a3792f92b116851023620d862cac6d2b5542de41390b6b8d223074db94193f0ee6dfcc9d6588ea3e77173f73c7fdfc5f9a1e1044c597636fe275d9ff4b76a12b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exe

    Filesize

    316KB

    MD5

    135eeb256e92d261066cfd3ffd31fb3e

    SHA1

    5c275ffd2ab1359249bae8c91bebcab19a185e91

    SHA256

    f0fe346146c30129ed6f507906c973f1a54c7d8dd8821c97e9b6edc42545699d

    SHA512

    a3792f92b116851023620d862cac6d2b5542de41390b6b8d223074db94193f0ee6dfcc9d6588ea3e77173f73c7fdfc5f9a1e1044c597636fe275d9ff4b76a12b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\mbr.exe

    Filesize

    47KB

    MD5

    8562ed46d745dceb3cc268693ca25c83

    SHA1

    309067f0c9703084654495a47e67f7a40824700d

    SHA256

    ea5d21e6598d52b30e9d055bc406c6227bbadb5c493addb27b32fb16a6dcae8c

    SHA512

    52f23e70f7ea6eab1a50a4008e563d787732f7361dfe10c48f39dae42bce023c90449c9a903733fab13c49b50f8c4fa7d4864ab26c69326aab0149c765fd677b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\mbr.exe

    Filesize

    47KB

    MD5

    8562ed46d745dceb3cc268693ca25c83

    SHA1

    309067f0c9703084654495a47e67f7a40824700d

    SHA256

    ea5d21e6598d52b30e9d055bc406c6227bbadb5c493addb27b32fb16a6dcae8c

    SHA512

    52f23e70f7ea6eab1a50a4008e563d787732f7361dfe10c48f39dae42bce023c90449c9a903733fab13c49b50f8c4fa7d4864ab26c69326aab0149c765fd677b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\sound.vbs

    Filesize

    216B

    MD5

    c36c15e1f99e1c0d093b9b089b1073c5

    SHA1

    47a237639f83d8de0c2034831ff3e12a3bad7408

    SHA256

    3d6123cae8ac645d9c9d33b0dada869a7fdd5117a2bf0f9080e4e30fe5bed736

    SHA512

    4283b45c6483e2ed6e9741f5937bb7851e101fb4710bd687a73a77b5abcb820d2480deaee50c8e87a7f225cee2430836da75d201838e9d989e91f3c0c0c60d1f

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\start_dobrota.bat

    Filesize

    220B

    MD5

    99ee6716bf6dd074e52a923e74f9fa70

    SHA1

    42494346592ca59d2d895ec77d37d83ce2dbed1a

    SHA256

    d51fd681ba6346842afe2f9cb7ae117cb667986af0c67e28664124173b183740

    SHA512

    2179380ec9630dbce4f7637f4e6fe8164d61cb41c2d43be98d97a7116aa5d7a181a8bdb4ed3f3d147aaec9dd2152dd9a23e94e3a67c2bd7f12e4b205826b6732

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\start_dobrota.bat

    Filesize

    220B

    MD5

    99ee6716bf6dd074e52a923e74f9fa70

    SHA1

    42494346592ca59d2d895ec77d37d83ce2dbed1a

    SHA256

    d51fd681ba6346842afe2f9cb7ae117cb667986af0c67e28664124173b183740

    SHA512

    2179380ec9630dbce4f7637f4e6fe8164d61cb41c2d43be98d97a7116aa5d7a181a8bdb4ed3f3d147aaec9dd2152dd9a23e94e3a67c2bd7f12e4b205826b6732

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\toonel.exe

    Filesize

    317KB

    MD5

    a84257e64cfbd9f6c0a574af416bc0d1

    SHA1

    245649583806d63abb1b2dc1947feccc8ce4a4bc

    SHA256

    fe7ff85b95ec06ce0f3cb49fdfa4d36de1f08669d36d381794aaf597510afad7

    SHA512

    6fc85ee0f8c75a25193fc4883a734704a8190253348c158b9cef4b918cffee5c8997c5248ec2bc793f66978e8cb4c5233d300d112f1d7750bc660698414865c2

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\toonel.exe

    Filesize

    317KB

    MD5

    a84257e64cfbd9f6c0a574af416bc0d1

    SHA1

    245649583806d63abb1b2dc1947feccc8ce4a4bc

    SHA256

    fe7ff85b95ec06ce0f3cb49fdfa4d36de1f08669d36d381794aaf597510afad7

    SHA512

    6fc85ee0f8c75a25193fc4883a734704a8190253348c158b9cef4b918cffee5c8997c5248ec2bc793f66978e8cb4c5233d300d112f1d7750bc660698414865c2

  • \Users\Admin\AppData\Local\Temp\RarSFX0\INVERS.exe

    Filesize

    2.3MB

    MD5

    5134f289dbf4abae370e3f36b637b73e

    SHA1

    c78d3f2d00dc47da0112a74df665c7a84a8e32c3

    SHA256

    e69c9383b5d9fe4e069ddee15797c52e9116f883ad3b1717d2519621ab2751b2

    SHA512

    0bf61a04b93b1ba5b8a0e2d9a1c333cc4605350a4c797cc9f5f78fec698d6f4fd62d329513ed406e76a06aa6af0f00d206da723e5a33315ce8de7f68f2002cb5

  • \Users\Admin\AppData\Local\Temp\RarSFX0\crazyinvers.exe

    Filesize

    2.3MB

    MD5

    a44458813e819777013eb3e644d74362

    SHA1

    2dd0616ca78e22464cf0cf68ef7915358a16f9ee

    SHA256

    47f0e9a90d45b193e81d3e60b7a43e5a4550a07a3dd1f7c98110fde12265d999

    SHA512

    1a4723a36f55cf696f33a7927571bda403e81ced32fda85c7cf25c8458897fb187e46bf5f80c26542725a9a7e5aa0e961fd3f3b110ae8f54b3b96b3e5dfc8215

  • \Users\Admin\AppData\Local\Temp\RarSFX0\crazywarningicons.exe

    Filesize

    1.2MB

    MD5

    e21bb4749a8b1b6fc26a7bcf57781836

    SHA1

    89cb0bd80d691ca650ad01551be3acefa2256ebd

    SHA256

    0ecbb8099ed1d9a1673165d3c4c9bbde88dd9678540a98b99434ff23b9e6d82c

    SHA512

    b0ccf421e415f94b6f0497dd041a8e7693d01d72cd577eca771d2049516f7a0c8c7221da642e5c38d5bc95a2335279d36f956314bda442b99a2d244bcc73b47b

  • \Users\Admin\AppData\Local\Temp\RarSFX0\erroricons.exe

    Filesize

    316KB

    MD5

    7f31508d95be3fe50e4e9aa646e86a12

    SHA1

    c61b439d6e17d630728f48c09b36af2647940748

    SHA256

    994efdb644ca1acb029dfd8d8eeba440e1cb74d93841b17f21165b9900730b15

    SHA512

    2e2b01e84a3476b47a9c703b71ce31887e4a4fa9340780f0cbbd20601be621bf00b9619df8bec0e81b2825550150c477c5071d921104a4c6265ef2d5a9e77eda

  • \Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exe

    Filesize

    316KB

    MD5

    135eeb256e92d261066cfd3ffd31fb3e

    SHA1

    5c275ffd2ab1359249bae8c91bebcab19a185e91

    SHA256

    f0fe346146c30129ed6f507906c973f1a54c7d8dd8821c97e9b6edc42545699d

    SHA512

    a3792f92b116851023620d862cac6d2b5542de41390b6b8d223074db94193f0ee6dfcc9d6588ea3e77173f73c7fdfc5f9a1e1044c597636fe275d9ff4b76a12b

  • \Users\Admin\AppData\Local\Temp\RarSFX0\mbr.exe

    Filesize

    47KB

    MD5

    8562ed46d745dceb3cc268693ca25c83

    SHA1

    309067f0c9703084654495a47e67f7a40824700d

    SHA256

    ea5d21e6598d52b30e9d055bc406c6227bbadb5c493addb27b32fb16a6dcae8c

    SHA512

    52f23e70f7ea6eab1a50a4008e563d787732f7361dfe10c48f39dae42bce023c90449c9a903733fab13c49b50f8c4fa7d4864ab26c69326aab0149c765fd677b

  • \Users\Admin\AppData\Local\Temp\RarSFX0\mbr.exe

    Filesize

    47KB

    MD5

    8562ed46d745dceb3cc268693ca25c83

    SHA1

    309067f0c9703084654495a47e67f7a40824700d

    SHA256

    ea5d21e6598d52b30e9d055bc406c6227bbadb5c493addb27b32fb16a6dcae8c

    SHA512

    52f23e70f7ea6eab1a50a4008e563d787732f7361dfe10c48f39dae42bce023c90449c9a903733fab13c49b50f8c4fa7d4864ab26c69326aab0149c765fd677b

  • \Users\Admin\AppData\Local\Temp\RarSFX0\toonel.exe

    Filesize

    317KB

    MD5

    a84257e64cfbd9f6c0a574af416bc0d1

    SHA1

    245649583806d63abb1b2dc1947feccc8ce4a4bc

    SHA256

    fe7ff85b95ec06ce0f3cb49fdfa4d36de1f08669d36d381794aaf597510afad7

    SHA512

    6fc85ee0f8c75a25193fc4883a734704a8190253348c158b9cef4b918cffee5c8997c5248ec2bc793f66978e8cb4c5233d300d112f1d7750bc660698414865c2

  • memory/1056-101-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1100-157-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/1392-152-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/1740-153-0x0000000000400000-0x0000000000582000-memory.dmp

    Filesize

    1.5MB

  • memory/1744-154-0x0000000000400000-0x0000000000541000-memory.dmp

    Filesize

    1.3MB

  • memory/1824-156-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2004-155-0x0000000000400000-0x0000000000582000-memory.dmp

    Filesize

    1.5MB