510eb0ca2d2151ce2e37be81e406be4c36d9039ac8af19e188937d816ea92499

General

Target

055dc16dba2c7033fb14c27571359517.exe
Size

858KB
MD5

055dc16dba2c7033fb14c27571359517
SHA1

408e1180b330225b1c181b9bf6703898027772cd
SHA256

510eb0ca2d2151ce2e37be81e406be4c36d9039ac8af19e188937d816ea92499
SHA512

ba29e2b31bcbd9ce72363def1efde43933549803131a1f7859f9caa91c19c741d65c762584425e5e692ae888ef28d814e41accf1b6414e5b4e10ca9412032204
SSDEEP

12288:qk5b5EuwfLs+mCVhgPjxj0u09MfEt6Z66B+3UBhfVvfBCUaoQUXByY6XMxP+y+Yf:qIqmnJ9Bf86ZJh/BfQXjY6XOIYeaT

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

isecurity.exe

pid process

2192 isecurity.exe
Loads dropped DLL 3 IoCs

Processes:

055dc16dba2c7033fb14c27571359517.exe

pid process

2852 055dc16dba2c7033fb14c27571359517.exe
2852 055dc16dba2c7033fb14c27571359517.exe
2852 055dc16dba2c7033fb14c27571359517.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

isecurity.exe

description ioc process

File opened for modification \??\PhysicalDrive0 isecurity.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

055dc16dba2c7033fb14c27571359517.exe

pid process

2852 055dc16dba2c7033fb14c27571359517.exe

pid	process
2192	isecurity.exe

pid	process
2852	055dc16dba2c7033fb14c27571359517.exe
2852	055dc16dba2c7033fb14c27571359517.exe
2852	055dc16dba2c7033fb14c27571359517.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	isecurity.exe

pid	process
2852	055dc16dba2c7033fb14c27571359517.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

055dc16dba2c7033fb14c27571359517.exe

description	pid	process	target process
PID 2852 wrote to memory of 2192	2852	055dc16dba2c7033fb14c27571359517.exe	isecurity.exe
PID 2852 wrote to memory of 2192	2852	055dc16dba2c7033fb14c27571359517.exe	isecurity.exe
PID 2852 wrote to memory of 2192	2852	055dc16dba2c7033fb14c27571359517.exe	isecurity.exe
PID 2852 wrote to memory of 2192	2852	055dc16dba2c7033fb14c27571359517.exe	isecurity.exe

C:\Users\Admin\AppData\Local\Temp\055dc16dba2c7033fb14c27571359517.exe
"C:\Users\Admin\AppData\Local\Temp\055dc16dba2c7033fb14c27571359517.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852

C:\ProgramData\isecurity.exe
C:\ProgramData\isecurity.exe
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\isecurity.exe
Filesize
91KB

MD5
e2a2ada3bba854a86e6ab587c5b0998b

SHA1
647b0ef4ac8e2ca6baac79111ca66d22fb960243

SHA256
2a9adf179218ddb4cefc15126eb2c09d8286867368135699aff3faf4f4ead047

SHA512
dc41f682b3efa91faa1b205d2f4d6e289691a471f9abba44111b2754fa468cb974b5e1fb56ee271feab6c8202a38f3824f1d474391b9426ee21797db3b1ac44d

Download Submit
\ProgramData\isecurity.exe
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2192-30-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-43-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-44-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-21-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-23-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-25-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2192-24-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-20-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-29-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-42-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-27-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-28-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-45-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-41-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-36-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-31-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-34-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-35-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-32-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2192-37-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-38-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-39-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2192-40-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2852-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2852-2-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2852-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2852-8-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2852-5-0x0000000076F30000-0x0000000076F31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing