3a655bfce1ba9194a21324fbdeb7315c5fe9472dd692ead793d642fe7048fe8a

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a655bfce1ba9194a21324fbdeb7315c5fe9472dd692ead793d642fe7048fe8a.exe
Size

11.6MB
MD5

e1ce11a5043ec853b12f471a24b99b28
SHA1

c08d6f3ec45bd14e1ab045dfa2a89a99b13cb149
SHA256

3a655bfce1ba9194a21324fbdeb7315c5fe9472dd692ead793d642fe7048fe8a
SHA512

2836efaac2ad07db1be2650165b7fc175b7acbe2ac38e167f36ddcbacb575a4e6480a184c038b17797d59a9eef940f56ac78c006b0c45ce9f23c819027c5a3be
SSDEEP

196608:/zldA7NU0lB5gDbTg78kE8DHkmAiOYahvFveNMb2JGsZZymsIB6Ypd7m:LgnBqXTgFkThvFlb2JGsZQmzP7m

Score

7^/10

bootkit persistence upx vmprotect

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1728-41-0x0000000000340000-0x000000000034B000-memory.dmp	upx
behavioral1/memory/1728-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-66-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-68-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-70-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-71-0x0000000000340000-0x000000000034B000-memory.dmp	upx
behavioral1/memory/1728-74-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-78-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-84-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-90-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-96-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-98-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1728-100-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1728-5-0x0000000000400000-0x0000000001F0F000-memory.dmp	vmprotect
behavioral1/memory/1728-58-0x0000000000400000-0x0000000001F0F000-memory.dmp	vmprotect
behavioral1/memory/1728-101-0x0000000000400000-0x0000000001F0F000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	3a655bfce1ba9194a21324fbdeb7315c5fe9472dd692ead793d642fe7048fe8a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1728	3a655bfce1ba9194a21324fbdeb7315c5fe9472dd692ead793d642fe7048fe8a.exe
1728	3a655bfce1ba9194a21324fbdeb7315c5fe9472dd692ead793d642fe7048fe8a.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1728	3a655bfce1ba9194a21324fbdeb7315c5fe9472dd692ead793d642fe7048fe8a.exe
1728	3a655bfce1ba9194a21324fbdeb7315c5fe9472dd692ead793d642fe7048fe8a.exe
1728	3a655bfce1ba9194a21324fbdeb7315c5fe9472dd692ead793d642fe7048fe8a.exe

C:\Users\Admin\AppData\Local\Temp\3a655bfce1ba9194a21324fbdeb7315c5fe9472dd692ead793d642fe7048fe8a.exe
"C:\Users\Admin\AppData\Local\Temp\3a655bfce1ba9194a21324fbdeb7315c5fe9472dd692ead793d642fe7048fe8a.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1728-2-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1728-5-0x0000000000400000-0x0000000001F0F000-memory.dmp

Filesize
27.1MB

Download
memory/1728-6-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1728-4-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1728-8-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1728-10-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1728-13-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1728-15-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1728-18-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1728-20-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1728-23-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1728-28-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1728-25-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1728-30-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1728-31-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1728-33-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1728-35-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1728-37-0x0000000077D10000-0x0000000077D11000-memory.dmp

Filesize
4KB

Download
memory/1728-41-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/1728-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-58-0x0000000000400000-0x0000000001F0F000-memory.dmp

Filesize
27.1MB

Download
memory/1728-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-66-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-68-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-70-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-71-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/1728-74-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-78-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-84-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-90-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-93-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-96-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-98-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-99-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1728-100-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1728-101-0x0000000000400000-0x0000000001F0F000-memory.dmp

Filesize
27.1MB

Download