30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801

Analysis

max time kernel
162s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe
Size

12.8MB
MD5

d0782609019d12a3cb20d6abea7e2770
SHA1

895d299a09820e7f48d35086f15d1560d1e0d196
SHA256

30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801
SHA512

942696ee9f925d0d0748f2be88ac4111c4772042ce8a62294f69d656c94139667b7d7ed4f6e0b4829ca5f52fd7de926591bad7696f9c12b534f90a0f79363fe5
SSDEEP

393216:VLj9mBKlkIFi1XSZf6knr8cX/3AGYn8tc:VLj9vkzXSZik4i3Nu

Score

7^/10

bootkit persistence upx vmprotect

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1096-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-16-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-20-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-24-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-26-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-28-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1096-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1096-0-0x0000000000400000-0x00000000019B6000-memory.dmp	vmprotect
behavioral2/memory/1096-11-0x0000000000400000-0x00000000019B6000-memory.dmp	vmprotect
behavioral2/memory/1096-62-0x0000000000400000-0x00000000019B6000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1096	30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe
1096	30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe
1096	30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe
1096	30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1096	30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1096	30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe
1096	30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe
1096	30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe
1096	30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe

C:\Users\Admin\AppData\Local\Temp\30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe
"C:\Users\Admin\AppData\Local\Temp\30ee20474945532aada7afe623aeba2ef0d34a3db0decc80b8888dcc9621d801.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-0-0x0000000000400000-0x00000000019B6000-memory.dmp

Filesize
21.7MB

Download
memory/1096-1-0x0000000001B60000-0x0000000001B61000-memory.dmp

Filesize
4KB

Download
memory/1096-2-0x0000000001B80000-0x0000000001B81000-memory.dmp

Filesize
4KB

Download
memory/1096-3-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download
memory/1096-5-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

Filesize
4KB

Download
memory/1096-4-0x0000000001CE0000-0x0000000001CE1000-memory.dmp

Filesize
4KB

Download
memory/1096-6-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/1096-7-0x0000000001D10000-0x0000000001D11000-memory.dmp

Filesize
4KB

Download
memory/1096-11-0x0000000000400000-0x00000000019B6000-memory.dmp

Filesize
21.7MB

Download
memory/1096-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-16-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-18-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-20-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-24-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-26-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-28-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1096-60-0x00000000772A0000-0x0000000077440000-memory.dmp

Filesize
1.6MB

Download
memory/1096-62-0x0000000000400000-0x00000000019B6000-memory.dmp

Filesize
21.7MB

Download
memory/1096-63-0x00000000772A0000-0x0000000077440000-memory.dmp

Filesize
1.6MB

Download