1ab5e7d70a2c29d4c1fdc46f48722d7cc3164a7e5209e6c897d11294150de43d

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09/10/2023, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ab5e7d70a2c29d4c1fdc46f48722d7cc3164a7e5209e6c897d11294150de43d.exe
Size

11.6MB
MD5

41c462b652ac9f850e474f32e4440a34
SHA1

3734e2b2b747082aad181b6dcbd5edb697acd654
SHA256

1ab5e7d70a2c29d4c1fdc46f48722d7cc3164a7e5209e6c897d11294150de43d
SHA512

e326bf09cb605920ed278059b38614e8d9eced04006d1260fa5447b9f75f20631a259b559c7fe1e31f6c7077ca859b4ad20fb30f38c429ba9e45a49606653044
SSDEEP

196608:nOQLz72/YE/MSfH1ApdFNrGTv3u18uTnUhVCwkMT2uu2/vmRclW/h/SEWpJ/ix07:NzsFEPpr9SaehVCMCuujcGg1Jaa/z

Score

7^/10

bootkit persistence upx vmprotect

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2200-40-0x0000000001F50000-0x0000000001F5B000-memory.dmp	upx
behavioral1/memory/2200-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-42-0x0000000001F50000-0x0000000001F5B000-memory.dmp	upx
behavioral1/memory/2200-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-62-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-66-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-85-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-89-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-92-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-95-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-97-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-99-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2200-6-0x0000000000400000-0x0000000001F10000-memory.dmp	vmprotect
behavioral1/memory/2200-58-0x0000000000400000-0x0000000001F10000-memory.dmp	vmprotect
behavioral1/memory/2200-100-0x0000000000400000-0x0000000001F10000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	1ab5e7d70a2c29d4c1fdc46f48722d7cc3164a7e5209e6c897d11294150de43d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2200	1ab5e7d70a2c29d4c1fdc46f48722d7cc3164a7e5209e6c897d11294150de43d.exe
2200	1ab5e7d70a2c29d4c1fdc46f48722d7cc3164a7e5209e6c897d11294150de43d.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2200	1ab5e7d70a2c29d4c1fdc46f48722d7cc3164a7e5209e6c897d11294150de43d.exe
2200	1ab5e7d70a2c29d4c1fdc46f48722d7cc3164a7e5209e6c897d11294150de43d.exe
2200	1ab5e7d70a2c29d4c1fdc46f48722d7cc3164a7e5209e6c897d11294150de43d.exe

C:\Users\Admin\AppData\Local\Temp\1ab5e7d70a2c29d4c1fdc46f48722d7cc3164a7e5209e6c897d11294150de43d.exe
"C:\Users\Admin\AppData\Local\Temp\1ab5e7d70a2c29d4c1fdc46f48722d7cc3164a7e5209e6c897d11294150de43d.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-0-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2200-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2200-4-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2200-6-0x0000000000400000-0x0000000001F10000-memory.dmp

Filesize
27.1MB

Download
memory/2200-5-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2200-8-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2200-10-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2200-13-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2200-15-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2200-18-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2200-20-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2200-23-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/2200-25-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/2200-28-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/2200-30-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/2200-31-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/2200-33-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/2200-35-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/2200-37-0x0000000077D70000-0x0000000077D71000-memory.dmp

Filesize
4KB

Download
memory/2200-40-0x0000000001F50000-0x0000000001F5B000-memory.dmp

Filesize
44KB

Download
memory/2200-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-42-0x0000000001F50000-0x0000000001F5B000-memory.dmp

Filesize
44KB

Download
memory/2200-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-58-0x0000000000400000-0x0000000001F10000-memory.dmp

Filesize
27.1MB

Download
memory/2200-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-62-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-64-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-66-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-85-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-89-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-92-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-95-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-97-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-98-0x0000000001F90000-0x0000000001F91000-memory.dmp

Filesize
4KB

Download
memory/2200-99-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-100-0x0000000000400000-0x0000000001F10000-memory.dmp

Filesize
27.1MB

Download