7872ccdb98a1f1ff5af88dedb866abc1e589f33d637db87ac9fd8c915119ea84

General

Target

7872ccdb98a1f1ff5af88dedb866abc1e589f33d637db87ac9fd8c915119ea84.exe
Size

199KB
MD5

48ad5b7c0c14fa6052b0660a9e9c042b
SHA1

4e8598861c51edebbbfe4af5b87ba48cb6e873b4
SHA256

7872ccdb98a1f1ff5af88dedb866abc1e589f33d637db87ac9fd8c915119ea84
SHA512

080bbd8d4f038e91fd1bcecf06c5e5e8c368da3651d3ec4fdaebffea32d2de423d6f72c90a1b47e197676b1c6d1e1e77cef0a841c93ac2008750811d5eb536c1
SSDEEP

3072:fP5gvNVLIfHQja1RfmLQADwSKkhU+tLgT5lODbiC8r1PkT:X2vnSwjaOcADw9cUeCOf

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1780	ptgro.exe

Executes dropped EXE 2 IoCs

pid	Process
1780	ptgro.exe
1404	tuh.exe

Loads dropped DLL 1 IoCs

pid	Process
1404	tuh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Depend = "c:\\Program Files\\xltfy\\tuh.exe \"c:\\Program Files\\xltfy\\tuhcs.dll\",Compliance"	tuh.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	tuh.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\xltfy	ptgro.exe
File created	\??\c:\Program Files\xltfy\tuhcs.dll	ptgro.exe
File created	\??\c:\Program Files\xltfy\tuh.exe	ptgro.exe
File opened for modification	\??\c:\Program Files\xltfy\tuh.exe	ptgro.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2428	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	tuh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3120	7872ccdb98a1f1ff5af88dedb866abc1e589f33d637db87ac9fd8c915119ea84.exe
1780	ptgro.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 2824	3120	7872ccdb98a1f1ff5af88dedb866abc1e589f33d637db87ac9fd8c915119ea84.exe	23
PID 3120 wrote to memory of 2824	3120	7872ccdb98a1f1ff5af88dedb866abc1e589f33d637db87ac9fd8c915119ea84.exe	23
PID 3120 wrote to memory of 2824	3120	7872ccdb98a1f1ff5af88dedb866abc1e589f33d637db87ac9fd8c915119ea84.exe	23
PID 2824 wrote to memory of 2428	2824	cmd.exe	22
PID 2824 wrote to memory of 2428	2824	cmd.exe	22
PID 2824 wrote to memory of 2428	2824	cmd.exe	22
PID 2824 wrote to memory of 1780	2824	cmd.exe	47
PID 2824 wrote to memory of 1780	2824	cmd.exe	47
PID 2824 wrote to memory of 1780	2824	cmd.exe	47
PID 1780 wrote to memory of 1404	1780	ptgro.exe	46
PID 1780 wrote to memory of 1404	1780	ptgro.exe	46
PID 1780 wrote to memory of 1404	1780	ptgro.exe	46

C:\Users\Admin\AppData\Local\Temp\7872ccdb98a1f1ff5af88dedb866abc1e589f33d637db87ac9fd8c915119ea84.exe
"C:\Users\Admin\AppData\Local\Temp\7872ccdb98a1f1ff5af88dedb866abc1e589f33d637db87ac9fd8c915119ea84.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\ptgro.exe "C:\Users\Admin\AppData\Local\Temp\7872ccdb98a1f1ff5af88dedb866abc1e589f33d637db87ac9fd8c915119ea84.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Users\Admin\AppData\Local\Temp\ptgro.exe
    C:\Users\Admin\AppData\Local\Temp\\ptgro.exe "C:\Users\Admin\AppData\Local\Temp\7872ccdb98a1f1ff5af88dedb866abc1e589f33d637db87ac9fd8c915119ea84.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1780

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
1⤵
- Runs ping.exe
PID:2428

\??\c:\Program Files\xltfy\tuh.exe
"c:\Program Files\xltfy\tuh.exe" "c:\Program Files\xltfy\tuhcs.dll",Compliance C:\Users\Admin\AppData\Local\Temp\ptgro.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ptgro.exe

Filesize
200KB

MD5
421f0b317cf5fa340b81398cd2081be1

SHA1
9c71fd29765df73464dba2c16285a230414ac90d

SHA256
e71b260e0c697b0207e7840b7511fd9665e8e0cfeeda0a11d4e4d065d6ccf656

SHA512
7d7e209c73fabdb266fab06c53080c23c26d952ea3212f0af446de1de509fc1f38bd3ce6b357c95b05dff9a8e8bb64ce6e3b8ab109eb46fe9bcb1d9a6fa9b29c

Download Submit
memory/1404-18-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download
memory/1404-23-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download
memory/1404-21-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download
memory/1404-19-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download
memory/1780-8-0x0000000000400000-0x000000000044901D-memory.dmp

Filesize
292KB

Download
memory/1780-14-0x0000000000400000-0x000000000044901D-memory.dmp

Filesize
292KB

Download
memory/1780-9-0x0000000000400000-0x000000000044901D-memory.dmp

Filesize
292KB

Download
memory/3120-0-0x0000000000400000-0x000000000044901D-memory.dmp

Filesize
292KB

Download
memory/3120-4-0x0000000000400000-0x000000000044901D-memory.dmp

Filesize
292KB

Download
memory/3120-1-0x0000000000400000-0x000000000044901D-memory.dmp

Filesize
292KB

Download
memory/3120-2-0x0000000000400000-0x000000000044901D-memory.dmp

Filesize
292KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads