6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129

General

Target

6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe
Size

6.0MB
MD5

84bda1cf5f48bfd47d3eb310d50da81d
SHA1

2fb82fd0f8904855e6e6f0b9ebece6b32c6862e1
SHA256

6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129
SHA512

ab3e88250bdecb40055bdc6b7af371e192214a261440a237fd51fe460014b06bb6b9553d52d0e2008e96a60202156745d36ce2ec5d0a17ab543f9501b1e1a72d
SSDEEP

98304:jEpuvS7PEk5/jZMFUkWL+ikliXR+4qm5BmRmYYcQKNmL6yiwNUvZcmz9J:jiuvQ0SkWLLf+4FZwNv3cE9J

Score

7^/10

bootkit persistence vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2208-3-0x0000000000400000-0x0000000001406000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3712	2208	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2208	6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe
2208	6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2208	6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2208	6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2208	6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe
Token: SeShutdownPrivilege	2208	6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2208	6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe
2208	6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe
2208	6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe

C:\Users\Admin\AppData\Local\Temp\6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe
"C:\Users\Admin\AppData\Local\Temp\6c502b0ee6d7182d2269d0c441a63747312c2cc06f8b98a49cf3057ddb565129.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 4084
  2⤵
  - Program crash
  PID:3712

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2812

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:5760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2208-3-0x0000000000400000-0x0000000001406000-memory.dmp

Filesize
16.0MB

Download
memory/2208-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2208-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2208-6-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2208-8-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2208-10-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2208-13-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2208-15-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2208-18-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2208-20-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2208-23-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2208-25-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2208-28-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2208-30-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2208-31-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2208-33-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2208-35-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2208-37-0x0000000077130000-0x0000000077131000-memory.dmp

Filesize
4KB

Download
memory/2208-41-0x0000000002F90000-0x00000000030CC000-memory.dmp

Filesize
1.2MB

Download
memory/2208-42-0x0000000002F90000-0x00000000030CC000-memory.dmp

Filesize
1.2MB

Download
memory/2208-45-0x0000000002F90000-0x00000000030CC000-memory.dmp

Filesize
1.2MB

Download
memory/2812-432-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/5760-1073-0x0000000002860000-0x0000000002861000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads