5def381413fba68eb44ef49c9991bdea93daf3ae3ff4d86d0c0120c5b2bb49a4

General

Target

040a43a53026d1eb8a1b39fb1216e716.exe
Size

556KB
MD5

040a43a53026d1eb8a1b39fb1216e716
SHA1

9090487c6b239968f3e980f24d87f01e8a2f0c95
SHA256

5def381413fba68eb44ef49c9991bdea93daf3ae3ff4d86d0c0120c5b2bb49a4
SHA512

38706f6fa14f8c9120f7e63c76dc767ed071c2d4de016ddb5ee408bc8f614a72d5a5e66608d67f147bc1cdd952685ae1a49caa8624a1e782a4f9ae82ba002f85
SSDEEP

12288:Dlsns1q8NrrTCP5FyTNiQXsRgkEgAayFQQHzO:S8Nrr2DeNncJlQTO

Score

10^/10

bootkit persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

040a43a53026d1eb8a1b39fb1216e716.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\aerhuy5e4u.exe"	040a43a53026d1eb8a1b39fb1216e716.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\aerhuy5e4u.exe"	040a43a53026d1eb8a1b39fb1216e716.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

040a43a53026d1eb8a1b39fb1216e716.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{aa99ucHB-owsT-VCg5-qTJd-VaclA8T7Rr1s}	040a43a53026d1eb8a1b39fb1216e716.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{aa99ucHB-owsT-VCg5-qTJd-VaclA8T7Rr1s}\WftacQBXWC5kcdU = "\"C:\\Users\\Admin\\AppData\\Roaming\\aerhuy5e4u.exe\" /ActiveX"	040a43a53026d1eb8a1b39fb1216e716.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\dwlGina3.dll	acprotect

Loads dropped DLL 2 IoCs

Processes:

040a43a53026d1eb8a1b39fb1216e716.exe

pid process

4708 040a43a53026d1eb8a1b39fb1216e716.exe
4708 040a43a53026d1eb8a1b39fb1216e716.exe

pid	process
4708	040a43a53026d1eb8a1b39fb1216e716.exe
4708	040a43a53026d1eb8a1b39fb1216e716.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4708-8-0x0000000000400000-0x00000000004A3000-memory.dmp	upx
behavioral2/memory/4708-10-0x0000000000400000-0x00000000004A3000-memory.dmp	upx
behavioral2/memory/4708-13-0x0000000000400000-0x00000000004A3000-memory.dmp	upx
behavioral2/memory/4708-14-0x0000000000400000-0x00000000004A3000-memory.dmp	upx
behavioral2/memory/4708-15-0x0000000000400000-0x00000000004A3000-memory.dmp	upx
behavioral2/memory/4708-19-0x0000000000400000-0x00000000004A3000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\dwlGina3.dll	upx
behavioral2/memory/4708-24-0x00000000024C0000-0x0000000002510000-memory.dmp	upx
behavioral2/memory/4708-26-0x0000000000400000-0x00000000004A3000-memory.dmp	upx
behavioral2/memory/4708-36-0x0000000000400000-0x00000000004A3000-memory.dmp	upx
behavioral2/memory/4708-37-0x0000000000400000-0x00000000004A3000-memory.dmp	upx
behavioral2/memory/4708-38-0x0000000000400000-0x00000000004A3000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

040a43a53026d1eb8a1b39fb1216e716.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WftacQBXWC5kcdU = "C:\\Users\\Admin\\AppData\\Roaming\\aerhuy5e4u.exe"	040a43a53026d1eb8a1b39fb1216e716.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WftacQBXWC5kcdU = "C:\\Users\\Admin\\AppData\\Roaming\\aerhuy5e4u.exe"	040a43a53026d1eb8a1b39fb1216e716.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

040a43a53026d1eb8a1b39fb1216e716.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	040a43a53026d1eb8a1b39fb1216e716.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

040a43a53026d1eb8a1b39fb1216e716.exe

description ioc process

File opened for modification \??\PhysicalDrive0 040a43a53026d1eb8a1b39fb1216e716.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	040a43a53026d1eb8a1b39fb1216e716.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

040a43a53026d1eb8a1b39fb1216e716.exe040a43a53026d1eb8a1b39fb1216e716.exe

description	pid	process	target process
PID 4720 set thread context of 4964	4720	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4964 set thread context of 4708	4964	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3232 4708 WerFault.exe 040a43a53026d1eb8a1b39fb1216e716.exe

pid	pid_target	process	target process
3232	4708	WerFault.exe	040a43a53026d1eb8a1b39fb1216e716.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

040a43a53026d1eb8a1b39fb1216e716.exe040a43a53026d1eb8a1b39fb1216e716.exe040a43a53026d1eb8a1b39fb1216e716.exe

pid	process
4720	040a43a53026d1eb8a1b39fb1216e716.exe
4964	040a43a53026d1eb8a1b39fb1216e716.exe
4708	040a43a53026d1eb8a1b39fb1216e716.exe
4708	040a43a53026d1eb8a1b39fb1216e716.exe
4708	040a43a53026d1eb8a1b39fb1216e716.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

040a43a53026d1eb8a1b39fb1216e716.exe040a43a53026d1eb8a1b39fb1216e716.exe

C:\Users\Admin\AppData\Local\Temp\040a43a53026d1eb8a1b39fb1216e716.exe
"C:\Users\Admin\AppData\Local\Temp\040a43a53026d1eb8a1b39fb1216e716.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720

C:\Users\Admin\AppData\Local\Temp\040a43a53026d1eb8a1b39fb1216e716.exe
"C:\Users\Admin\AppData\Local\Temp\040a43a53026d1eb8a1b39fb1216e716.exe"
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Local\Temp\040a43a53026d1eb8a1b39fb1216e716.exe
"C:\Users\Admin\AppData\Local\Temp\040a43a53026d1eb8a1b39fb1216e716.exe"
3⤵
- Modifies WinLogon for persistence
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
- Suspicious use of SetWindowsHookEx
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 776
4⤵
- Program crash
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4708 -ip 4708
1⤵
PID:3036

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

2

T1547.004

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

4

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Modify Registry

4

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dwlGina3.dll
Filesize
131KB

MD5
456f8bc05e54621c857f013aaad94c9e

SHA1
0fab3946fdd69ff134f39bef38d59375778ab54a

SHA256
7dec9b1f3a56e65b26b724f0df4a77f47ac8c99407d2e98b40d7da93ec431718

SHA512
03929db4369c38c314370d2e87a8b4d09c8e6a6b93c6f06a23a06da45ad6bda543cdab0d9e7cf2dbc80447a060f860f4a8d0cc21f6c6402f327b4f885935b111

Download Submit
memory/4708-15-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4708-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4708-19-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4708-16-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4708-37-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4708-13-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4708-14-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4708-36-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4708-38-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4708-29-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4708-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4708-24-0x00000000024C0000-0x0000000002510000-memory.dmp

Filesize
320KB

Download
memory/4708-25-0x0000000002520000-0x0000000002535000-memory.dmp

Filesize
84KB

Download
memory/4708-26-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4720-0-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4964-5-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4964-11-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4964-3-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download

description	pid	process	target process
PID 4720 wrote to memory of 4964	4720	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4720 wrote to memory of 4964	4720	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4720 wrote to memory of 4964	4720	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4720 wrote to memory of 4964	4720	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4720 wrote to memory of 4964	4720	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4720 wrote to memory of 4964	4720	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4720 wrote to memory of 4964	4720	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4720 wrote to memory of 4964	4720	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4964 wrote to memory of 4708	4964	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4964 wrote to memory of 4708	4964	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4964 wrote to memory of 4708	4964	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4964 wrote to memory of 4708	4964	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4964 wrote to memory of 4708	4964	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4964 wrote to memory of 4708	4964	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4964 wrote to memory of 4708	4964	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe
PID 4964 wrote to memory of 4708	4964	040a43a53026d1eb8a1b39fb1216e716.exe	040a43a53026d1eb8a1b39fb1216e716.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads