Analysis

  • max time kernel
    296s
  • max time network
    301s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2023, 20:18

General

  • Target

    boost-bo.exe

  • Size

    4.6MB

  • MD5

    cfd6e46ebad87e50cd5aa8d6b874d409

  • SHA1

    e2adb61cd2c84a6d00f6b646c0fc50d2065ef382

  • SHA256

    aa203ad2aac0bf8b392ec2add640ba020c2ed9938bea18dbf26631e9faa70f9d

  • SHA512

    679eb63a890cd85c24e94d96a1af7f6b125f0818eb1652626da7e99144e6378ee89f2949bc812c40b0761db84fb3f2b5a389ccad6cd192ff02a74d7e67d8ec1a

  • SSDEEP

    98304:z6+CSZXttEB+1r2oid4wr3v5wvVeqgkqXf0FGIrjMW94z9OUj:aSZnl1Coid4w34gkSIrYW94

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 8 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\boost-bo.exe
    "C:\Users\Admin\AppData\Local\Temp\boost-bo.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c start cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Response: {"success":true,"message":"Logged in!","info":{"username":"oesje","subscriptions":[{"subscription":"default","key":null,"expiry":"1830024720","timeleft":142041157,"level":"1"}],"ip":"154.61.71.13","hwid":null,"createdate":"1687983211","lastlogin":"1687983563"},"nonce":"5AvbpZ9hPzO211X3cfPWihBIOeiKK75g"} && timeout /t 5"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3716
      • C:\Windows\SysWOW64\cmd.exe
        cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Response: {"success":true,"message":"Logged in!","info":{"username":"oesje","subscriptions":[{"subscription":"default","key":null,"expiry":"1830024720","timeleft":142041157,"level":"1"}],"ip":"154.61.71.13","hwid":null,"createdate":"1687983211","lastlogin":"1687983563"},"nonce":"5AvbpZ9hPzO211X3cfPWihBIOeiKK75g"} && timeout /t 5"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2956
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 5
          4⤵
          • Delays execution with timeout.exe
          PID:688
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p
    1⤵
    • Drops file in System32 directory
    PID:1208

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1528-133-0x0000000000820000-0x0000000000CC0000-memory.dmp

          Filesize

          4.6MB

        • memory/1528-134-0x0000000005CD0000-0x0000000006274000-memory.dmp

          Filesize

          5.6MB

        • memory/1528-135-0x0000000005720000-0x00000000057B2000-memory.dmp

          Filesize

          584KB

        • memory/1528-136-0x0000000005650000-0x0000000005660000-memory.dmp

          Filesize

          64KB

        • memory/1528-137-0x00000000058D0000-0x00000000058DA000-memory.dmp

          Filesize

          40KB

        • memory/1528-138-0x0000000007520000-0x0000000007532000-memory.dmp

          Filesize

          72KB

        • memory/1528-141-0x0000000005650000-0x0000000005660000-memory.dmp

          Filesize

          64KB

        • memory/1528-142-0x0000000005650000-0x0000000005660000-memory.dmp

          Filesize

          64KB

        • memory/1528-143-0x000000000A0B0000-0x000000000A0EC000-memory.dmp

          Filesize

          240KB

        • memory/1528-144-0x0000000005650000-0x0000000005660000-memory.dmp

          Filesize

          64KB

        • memory/1528-145-0x0000000005650000-0x0000000005660000-memory.dmp

          Filesize

          64KB

        • memory/1528-146-0x0000000005650000-0x0000000005660000-memory.dmp

          Filesize

          64KB