e6b3c15ce544b132f38151b8c97fa7fd73eb3ac108ba0199ce6b72649c050c57

General

Target

5566307948dfd41c2eb5797799c08e41.exe
Size

3.6MB
MD5

5566307948dfd41c2eb5797799c08e41
SHA1

8ab0db21fd8fa12768ecc34e8a68d0d5428fd598
SHA256

e6b3c15ce544b132f38151b8c97fa7fd73eb3ac108ba0199ce6b72649c050c57
SHA512

db1fe9c7825671ca0b5df06b768b39a681d6f49c96aca60cf0c91ea007e9fc1cdcda4d6fcdba23a11985f76978a6d36549dd8b3b0a28755d3587e7e4088e598c
SSDEEP

98304:QeNjBijt85456c/RkrAQNH4WJYKpfFekDXGtMHPU:9jBijt8PmizY0/skDVc

Score

9^/10

bootkit discovery evasion persistence upx

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	5566307948dfd41c2eb5797799c08e41.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1488-1-0x0000000013140000-0x0000000013746000-memory.dmp	upx
behavioral1/memory/1488-5-0x0000000013140000-0x0000000013746000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\U:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\X:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\E:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\P:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\Q:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\S:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\T:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\G:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\J:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\L:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\M:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\O:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\R:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\I:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\K:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\N:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\V:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\W:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\Y:	5566307948dfd41c2eb5797799c08e41.exe
File opened (read-only)	\??\Z:	5566307948dfd41c2eb5797799c08e41.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	5566307948dfd41c2eb5797799c08e41.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	1488	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1488	5566307948dfd41c2eb5797799c08e41.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2304	1488	5566307948dfd41c2eb5797799c08e41.exe	28
PID 1488 wrote to memory of 2304	1488	5566307948dfd41c2eb5797799c08e41.exe	28
PID 1488 wrote to memory of 2304	1488	5566307948dfd41c2eb5797799c08e41.exe	28
PID 1488 wrote to memory of 2304	1488	5566307948dfd41c2eb5797799c08e41.exe	28
PID 1488 wrote to memory of 2660	1488	5566307948dfd41c2eb5797799c08e41.exe	29
PID 1488 wrote to memory of 2660	1488	5566307948dfd41c2eb5797799c08e41.exe	29
PID 1488 wrote to memory of 2660	1488	5566307948dfd41c2eb5797799c08e41.exe	29
PID 1488 wrote to memory of 2660	1488	5566307948dfd41c2eb5797799c08e41.exe	29

C:\Users\Admin\AppData\Local\Temp\5566307948dfd41c2eb5797799c08e41.exe
"C:\Users\Admin\AppData\Local\Temp\5566307948dfd41c2eb5797799c08e41.exe"
1⤵
- Enumerates VirtualBox registry keys
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\del.bat"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 260
  2⤵
  - Program crash
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Software Discovery

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
183B

MD5
e6d9c75e4964701480a3c3f6bc60eb1f

SHA1
704c9e46aa2b6796fdef459644728ba5b04bc5cb

SHA256
b7eb437cd16fe2f66f9a83d7933d6207477728bdac8bbb94b7f4a585e77f59a2

SHA512
174e8e30b166ad03f1474e716614607b89fec802c2d9502bf4fa5f9d3c9aa2d7fd9df2b6c5ebc74027ddadd55b04ac63036cdfeee1cdb6271b8fc0e969080ace

Download Submit
memory/1488-0-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/1488-1-0x0000000013140000-0x0000000013746000-memory.dmp

Filesize
6.0MB

Download
memory/1488-2-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1488-5-0x0000000013140000-0x0000000013746000-memory.dmp

Filesize
6.0MB

Download
memory/1488-7-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads