Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
24/01/2024, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
73030e7dc8db294e9763bb3e3c33dd13.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
General
- Target 73030e7dc8db294e9763bb3e3c33dd13.exe
- Size 812KB
- Sample240124-2c3hdsach7
- SHA256 72b49528da64448a989732b8c39a8efa045a6d549b1d05a2887524f36a80170c
- MD5 73030e7dc8db294e9763bb3e3c33dd13
- SHA1 15d03a0c208194bcd880c9a708381929b10a7cb3
- SHA512 9d3ca8dd8acac8489c94bee4e34c2aa217d1288a9d7d54982514f699e869e5b80c54976ec9370470992800e402a84babd9f6616f1d7b562af679ea445649b57a
- SSDEEP 12288:ZXQKfNYn7ntgfKNjCmz0gYq888riG03MolRPxNhQT758acUKZWw3U0Q1FS6Z5PHB:lxCn7ttnJ5YQltjGafDZWw3N6ZlB/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
latentbot
C2
-
fraieriimei2.zapto.org
Signatures
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 73030e7dc8db294e9763bb3e3c33dd13.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe - Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 73030e7dc8db294e9763bb3e3c33dd13.exe File opened for modification \??\PhysicalDrive0 explorer.exe - Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 4956 set thread context of 4640 4956 73030e7dc8db294e9763bb3e3c33dd13.exe 93 PID 4640 set thread context of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 2496 set thread context of 1108 2496 73030e7dc8db294e9763bb3e3c33dd13.exe 95 PID 1108 set thread context of 3480 1108 explorer.exe 99 PID 3480 set thread context of 3036 3480 explorer.exe 100 - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 73030e7dc8db294e9763bb3e3c33dd13.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 73030e7dc8db294e9763bb3e3c33dd13.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 73030e7dc8db294e9763bb3e3c33dd13.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 73030e7dc8db294e9763bb3e3c33dd13.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 73030e7dc8db294e9763bb3e3c33dd13.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeSecurityPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeTakeOwnershipPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeLoadDriverPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeSystemProfilePrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeSystemtimePrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeProfSingleProcessPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeIncBasePriorityPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeCreatePagefilePrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeBackupPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeRestorePrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeShutdownPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeDebugPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeSystemEnvironmentPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeChangeNotifyPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeRemoteShutdownPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeUndockPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeManageVolumePrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeImpersonatePrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeCreateGlobalPrivilege 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: 33 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: 34 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: 35 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: 36 2496 73030e7dc8db294e9763bb3e3c33dd13.exe Token: SeIncreaseQuotaPrivilege 3036 explorer.exe Token: SeSecurityPrivilege 3036 explorer.exe Token: SeTakeOwnershipPrivilege 3036 explorer.exe Token: SeLoadDriverPrivilege 3036 explorer.exe Token: SeSystemProfilePrivilege 3036 explorer.exe Token: SeSystemtimePrivilege 3036 explorer.exe Token: SeProfSingleProcessPrivilege 3036 explorer.exe Token: SeIncBasePriorityPrivilege 3036 explorer.exe Token: SeCreatePagefilePrivilege 3036 explorer.exe Token: SeBackupPrivilege 3036 explorer.exe Token: SeRestorePrivilege 3036 explorer.exe Token: SeShutdownPrivilege 3036 explorer.exe Token: SeDebugPrivilege 3036 explorer.exe Token: SeSystemEnvironmentPrivilege 3036 explorer.exe Token: SeChangeNotifyPrivilege 3036 explorer.exe Token: SeRemoteShutdownPrivilege 3036 explorer.exe Token: SeUndockPrivilege 3036 explorer.exe Token: SeManageVolumePrivilege 3036 explorer.exe Token: SeImpersonatePrivilege 3036 explorer.exe Token: SeCreateGlobalPrivilege 3036 explorer.exe Token: 33 3036 explorer.exe Token: 34 3036 explorer.exe Token: 35 3036 explorer.exe Token: 36 3036 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4956 73030e7dc8db294e9763bb3e3c33dd13.exe 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 1108 explorer.exe 3480 explorer.exe 3036 explorer.exe - Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 4956 wrote to memory of 4640 4956 73030e7dc8db294e9763bb3e3c33dd13.exe 93 PID 4956 wrote to memory of 4640 4956 73030e7dc8db294e9763bb3e3c33dd13.exe 93 PID 4956 wrote to memory of 4640 4956 73030e7dc8db294e9763bb3e3c33dd13.exe 93 PID 4956 wrote to memory of 4640 4956 73030e7dc8db294e9763bb3e3c33dd13.exe 93 PID 4956 wrote to memory of 4640 4956 73030e7dc8db294e9763bb3e3c33dd13.exe 93 PID 4956 wrote to memory of 4640 4956 73030e7dc8db294e9763bb3e3c33dd13.exe 93 PID 4956 wrote to memory of 4640 4956 73030e7dc8db294e9763bb3e3c33dd13.exe 93 PID 4956 wrote to memory of 4640 4956 73030e7dc8db294e9763bb3e3c33dd13.exe 93 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 4640 wrote to memory of 2496 4640 73030e7dc8db294e9763bb3e3c33dd13.exe 94 PID 2496 wrote to memory of 1108 2496 73030e7dc8db294e9763bb3e3c33dd13.exe 95 PID 2496 wrote to memory of 1108 2496 73030e7dc8db294e9763bb3e3c33dd13.exe 95 PID 2496 wrote to memory of 1108 2496 73030e7dc8db294e9763bb3e3c33dd13.exe 95 PID 2496 wrote to memory of 1108 2496 73030e7dc8db294e9763bb3e3c33dd13.exe 95 PID 2496 wrote to memory of 1108 2496 73030e7dc8db294e9763bb3e3c33dd13.exe 95 PID 1108 wrote to memory of 3480 1108 explorer.exe 99 PID 1108 wrote to memory of 3480 1108 explorer.exe 99 PID 1108 wrote to memory of 3480 1108 explorer.exe 99 PID 1108 wrote to memory of 3480 1108 explorer.exe 99 PID 1108 wrote to memory of 3480 1108 explorer.exe 99 PID 1108 wrote to memory of 3480 1108 explorer.exe 99 PID 1108 wrote to memory of 3480 1108 explorer.exe 99 PID 1108 wrote to memory of 3480 1108 explorer.exe 99 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100 PID 3480 wrote to memory of 3036 3480 explorer.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\73030e7dc8db294e9763bb3e3c33dd13.exe"C:\Users\Admin\AppData\Local\Temp\73030e7dc8db294e9763bb3e3c33dd13.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\73030e7dc8db294e9763bb3e3c33dd13.exe"C:\Users\Admin\AppData\Local\Temp\73030e7dc8db294e9763bb3e3c33dd13.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\73030e7dc8db294e9763bb3e3c33dd13.exe"C:\Users\Admin\AppData\Local\Temp\73030e7dc8db294e9763bb3e3c33dd13.exe"3⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"5⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"6⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3036
-
-
-
-
-