df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522

Analysis

max time kernel
130s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522.exe
Size

14.4MB
MD5

a95af56fb2606446bccab370e09566db
SHA1

8fb60b56e53d62f3d140cee1201c09fb14baea03
SHA256

df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522
SHA512

b45bbb8f9a3504fedd122ef49de231feba1d2e9e3ad5e55a1b034259867f09b5c3ccbc2fc8573804baf379e4c1f019c29ecba1edc55c238d2140fe4c77c77a82
SSDEEP

393216:fVU6VbBTpz/fe4FOdOCv+tII7CYUUDQ1Be9GKay:fVUuVB9sbG2YbUrKB

Score

7^/10

bootkit persistence upx vmprotect

Malware Config

Signatures

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3688-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-14-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-20-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-26-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3688-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/3688-7-0x0000000000400000-0x0000000001EF8000-memory.dmp	vmprotect
behavioral2/memory/3688-39-0x0000000000400000-0x0000000001EF8000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3688	df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522.exe
3688	df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522.exe
3688	df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522.exe
3688	df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3688	df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522.exe
3688	df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522.exe
3688	df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522.exe

C:\Users\Admin\AppData\Local\Temp\df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522.exe
"C:\Users\Admin\AppData\Local\Temp\df17b0cef460b5eb58b6010363bf937f2c91db2d3c01a021a6a31b841fcab522.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3688-0-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/3688-1-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/3688-3-0x0000000003DD0000-0x0000000003DD1000-memory.dmp

Filesize
4KB

Download
memory/3688-2-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/3688-4-0x0000000003DE0000-0x0000000003DE1000-memory.dmp

Filesize
4KB

Download
memory/3688-5-0x0000000003DF0000-0x0000000003DF1000-memory.dmp

Filesize
4KB

Download
memory/3688-7-0x0000000000400000-0x0000000001EF8000-memory.dmp

Filesize
27.0MB

Download
memory/3688-6-0x0000000003E00000-0x0000000003E01000-memory.dmp

Filesize
4KB

Download
memory/3688-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-14-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-20-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-26-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-39-0x0000000000400000-0x0000000001EF8000-memory.dmp

Filesize
27.0MB

Download
memory/3688-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-64-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3688-65-0x0000000006A60000-0x0000000006A61000-memory.dmp

Filesize
4KB

Download
memory/3688-67-0x00000000065B0000-0x00000000065B1000-memory.dmp

Filesize
4KB

Download
memory/3688-66-0x00000000065B0000-0x00000000065B1000-memory.dmp

Filesize
4KB

Download
memory/3688-69-0x00000000065C0000-0x00000000065C1000-memory.dmp

Filesize
4KB

Download
memory/3688-71-0x0000000006A60000-0x0000000006A61000-memory.dmp

Filesize
4KB

Download
memory/3688-70-0x0000000006A60000-0x0000000006A61000-memory.dmp

Filesize
4KB

Download
memory/3688-72-0x00000000065C0000-0x00000000065C1000-memory.dmp

Filesize
4KB

Download
memory/3688-73-0x00000000065B0000-0x00000000065B1000-memory.dmp

Filesize
4KB

Download
memory/3688-74-0x00000000065C0000-0x00000000065C1000-memory.dmp

Filesize
4KB

Download
memory/3688-75-0x00000000065C0000-0x00000000065C1000-memory.dmp

Filesize
4KB

Download
memory/3688-76-0x00000000065C0000-0x00000000065C1000-memory.dmp

Filesize
4KB

Download
memory/3688-77-0x00000000065C0000-0x00000000065C1000-memory.dmp

Filesize
4KB

Download
memory/3688-87-0x0000000006610000-0x0000000006611000-memory.dmp

Filesize
4KB

Download