Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
23-09-2023 14:16
Static task
static1
Behavioral task
behavioral1
Sample
IObit Driver Booster 11.0.0.21.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
IObit Driver Booster 11.0.0.21.exe
Resource
win10v2004-20230915-en
General
-
Target
IObit Driver Booster 11.0.0.21.exe
-
Size
23.8MB
-
MD5
72cafe441f7b5526d7fbd74b877db42f
-
SHA1
0ce90507748961fa9d0769d87a26318d8dd0bb13
-
SHA256
6f2fb40533acb394987715bdeec71588ae88a3782c2b372c0b0c221ed7b8ffba
-
SHA512
6d4d5aaf5956347028bcb657886d314b32a03f3306e027da067bd7dfd7cdd9fe563b6196551a6fe964601e97056fab22a68ddea503c2c49a2012867b58947a83
-
SSDEEP
393216:hIBVFnYCCP7YPkWzHTdUxSOVE9QWM+qtLT2Wcwa4Ovjz0bL+01KrP:4V+Cj79QT+kCEOLAbL31KL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1708 IObit Driver Booster 11.0.0.21.tmp -
Loads dropped DLL 5 IoCs
pid Process 2200 IObit Driver Booster 11.0.0.21.exe 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp 1708 IObit Driver Booster 11.0.0.21.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2200 wrote to memory of 1708 2200 IObit Driver Booster 11.0.0.21.exe 28 PID 2200 wrote to memory of 1708 2200 IObit Driver Booster 11.0.0.21.exe 28 PID 2200 wrote to memory of 1708 2200 IObit Driver Booster 11.0.0.21.exe 28 PID 2200 wrote to memory of 1708 2200 IObit Driver Booster 11.0.0.21.exe 28 PID 2200 wrote to memory of 1708 2200 IObit Driver Booster 11.0.0.21.exe 28 PID 2200 wrote to memory of 1708 2200 IObit Driver Booster 11.0.0.21.exe 28 PID 2200 wrote to memory of 1708 2200 IObit Driver Booster 11.0.0.21.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\IObit Driver Booster 11.0.0.21.exe"C:\Users\Admin\AppData\Local\Temp\IObit Driver Booster 11.0.0.21.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\is-S3GSD.tmp\IObit Driver Booster 11.0.0.21.tmp"C:\Users\Admin\AppData\Local\Temp\is-S3GSD.tmp\IObit Driver Booster 11.0.0.21.tmp" /SL5="$30158,24648767,64512,C:\Users\Admin\AppData\Local\Temp\IObit Driver Booster 11.0.0.21.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1708
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
911KB
MD51007aae9bab56b1ca7c432c8429399e5
SHA16b0e6b53a4cfd1d00e41d5c16577ee08d5a1afd6
SHA256e7a45ca3a1122049b91199c59d95adef650b104b96dec47c1f4dc227d2d807d2
SHA5124bc8674ab4b41b715e707fc89d67218db2f1c032de2f156a0b131350393fc8c32f3045c111a30ab2c84725c494d96fda37649755f60c4b1eeed925575da8d3db
-
Filesize
66KB
MD586a1311d51c00b278cb7f27796ea442e
SHA1ac08ac9d08f8f5380e2a9a65f4117862aa861a19
SHA256e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
SHA512129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
-
Filesize
3.0MB
MD5b0ca93ceb050a2feff0b19e65072bbb5
SHA17ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA2560e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
SHA51237242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
911KB
MD51007aae9bab56b1ca7c432c8429399e5
SHA16b0e6b53a4cfd1d00e41d5c16577ee08d5a1afd6
SHA256e7a45ca3a1122049b91199c59d95adef650b104b96dec47c1f4dc227d2d807d2
SHA5124bc8674ab4b41b715e707fc89d67218db2f1c032de2f156a0b131350393fc8c32f3045c111a30ab2c84725c494d96fda37649755f60c4b1eeed925575da8d3db