metasploit | 7918b15c30c95f9988f678cb41e531b5de016d23ad0a40c647144f42eadfa1fe

Analysis

max time kernel
5s
max time network
3s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/02/2024, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92672e4250adfd02901825f3996d588a.exe
Size 253KB
Sample240205-tc2bbsdeap
SHA256 7918b15c30c95f9988f678cb41e531b5de016d23ad0a40c647144f42eadfa1fe
MD5 92672e4250adfd02901825f3996d588a
SHA1 d0ec70642a0b576358c24a80994054a4727f2c5a
SHA512 833340ebb88fb23e07fb0b229744fdf6705b1405441c9d926f587dab1d838f0208df244c23fe0bca156999526bd4add17e691379bd581093c48f9a8c47f02eb4
SSDEEP 6144:UK0VsPXoRDaNItnM5GEJFwvP6bQ7yMP+DE827c23EOca:euoROIukSm6b7MP+Dd2FEOca
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor bootkit persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 14 IoCs

pid	Process
2796	lqgmrby.exe
2708	fwxhuyf.exe
2784	kbqpfis.exe
2268	vwravct.exe
268	upssppd.exe
2696	wkvvkpj.exe
1244	zgwnrks.exe
1936	vkrfyzd.exe
2144	amzaoxj.exe
368	cknqmcw.exe
816	cwaibga.exe
1600	csmnxej.exe
1636	gffnrgw.exe
2092	vrdtupi.exe

Loads dropped DLL 28 IoCs

pid	Process
2580	92672e4250adfd02901825f3996d588a.exe
2580	92672e4250adfd02901825f3996d588a.exe
2796	lqgmrby.exe
2796	lqgmrby.exe
2708	fwxhuyf.exe
2708	fwxhuyf.exe
2784	kbqpfis.exe
2784	kbqpfis.exe
2268	vwravct.exe
2268	vwravct.exe
268	upssppd.exe
268	upssppd.exe
2696	wkvvkpj.exe
2696	wkvvkpj.exe
1244	zgwnrks.exe
1244	zgwnrks.exe
1936	vkrfyzd.exe
1936	vkrfyzd.exe
2144	amzaoxj.exe
2144	amzaoxj.exe
368	cknqmcw.exe
368	cknqmcw.exe
816	cwaibga.exe
816	cwaibga.exe
1600	csmnxej.exe
1600	csmnxej.exe
1636	gffnrgw.exe
1636	gffnrgw.exe

Writes to the Master Boot Record (MBR) 1 TTPs 15 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	vrdtupi.exe
File opened for modification	\??\PhysicalDrive0	wkvvkpj.exe
File opened for modification	\??\PhysicalDrive0	csmnxej.exe
File opened for modification	\??\PhysicalDrive0	zgwnrks.exe
File opened for modification	\??\PhysicalDrive0	amzaoxj.exe
File opened for modification	\??\PhysicalDrive0	fwxhuyf.exe
File opened for modification	\??\PhysicalDrive0	kbqpfis.exe
File opened for modification	\??\PhysicalDrive0	cknqmcw.exe
File opened for modification	\??\PhysicalDrive0	cwaibga.exe
File opened for modification	\??\PhysicalDrive0	gffnrgw.exe
File opened for modification	\??\PhysicalDrive0	92672e4250adfd02901825f3996d588a.exe
File opened for modification	\??\PhysicalDrive0	upssppd.exe
File opened for modification	\??\PhysicalDrive0	vkrfyzd.exe
File opened for modification	\??\PhysicalDrive0	lqgmrby.exe
File opened for modification	\??\PhysicalDrive0	vwravct.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\zgwnrks.exe	wkvvkpj.exe
File opened for modification	C:\Windows\SysWOW64\vkrfyzd.exe	zgwnrks.exe
File opened for modification	C:\Windows\SysWOW64\vrdtupi.exe	gffnrgw.exe
File opened for modification	C:\Windows\SysWOW64\lqgmrby.exe	92672e4250adfd02901825f3996d588a.exe
File created	C:\Windows\SysWOW64\upssppd.exe	vwravct.exe
File opened for modification	C:\Windows\SysWOW64\wkvvkpj.exe	upssppd.exe
File opened for modification	C:\Windows\SysWOW64\amzaoxj.exe	vkrfyzd.exe
File created	C:\Windows\SysWOW64\csmnxej.exe	cwaibga.exe
File created	C:\Windows\SysWOW64\amzaoxj.exe	vkrfyzd.exe
File opened for modification	C:\Windows\SysWOW64\cknqmcw.exe	amzaoxj.exe
File opened for modification	C:\Windows\SysWOW64\cwaibga.exe	cknqmcw.exe
File created	C:\Windows\SysWOW64\vkrfyzd.exe	zgwnrks.exe
File created	C:\Windows\SysWOW64\cwaibga.exe	cknqmcw.exe
File created	C:\Windows\SysWOW64\gffnrgw.exe	csmnxej.exe
File created	C:\Windows\SysWOW64\cknqmcw.exe	amzaoxj.exe
File created	C:\Windows\SysWOW64\fwxhuyf.exe	lqgmrby.exe
File opened for modification	C:\Windows\SysWOW64\vwravct.exe	kbqpfis.exe
File created	C:\Windows\SysWOW64\wkvvkpj.exe	upssppd.exe
File created	C:\Windows\SysWOW64\zgwnrks.exe	wkvvkpj.exe
File created	C:\Windows\SysWOW64\vrdtupi.exe	gffnrgw.exe
File opened for modification	C:\Windows\SysWOW64\fwxhuyf.exe	lqgmrby.exe
File created	C:\Windows\SysWOW64\vwravct.exe	kbqpfis.exe
File opened for modification	C:\Windows\SysWOW64\upssppd.exe	vwravct.exe
File created	C:\Windows\SysWOW64\lqgmrby.exe	92672e4250adfd02901825f3996d588a.exe
File created	C:\Windows\SysWOW64\kbqpfis.exe	fwxhuyf.exe
File opened for modification	C:\Windows\SysWOW64\kbqpfis.exe	fwxhuyf.exe
File opened for modification	C:\Windows\SysWOW64\csmnxej.exe	cwaibga.exe
File opened for modification	C:\Windows\SysWOW64\gffnrgw.exe	csmnxej.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	vwravct.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	upssppd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	wkvvkpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	vrdtupi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	92672e4250adfd02901825f3996d588a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	92672e4250adfd02901825f3996d588a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	vkrfyzd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	amzaoxj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	92672e4250adfd02901825f3996d588a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	zgwnrks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	amzaoxj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	lqgmrby.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	zgwnrks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	amzaoxj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	cknqmcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	vrdtupi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	kbqpfis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	wkvvkpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	vwravct.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	upssppd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	upssppd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	vkrfyzd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	cknqmcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	cwaibga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	fwxhuyf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	kbqpfis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	csmnxej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	csmnxej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	vwravct.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	vkrfyzd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	cwaibga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	csmnxej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	gffnrgw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	gffnrgw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	fwxhuyf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	fwxhuyf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	zgwnrks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	cknqmcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	gffnrgw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	vrdtupi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	kbqpfis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	wkvvkpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	cwaibga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	lqgmrby.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	lqgmrby.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2796	2580	92672e4250adfd02901825f3996d588a.exe	28
PID 2580 wrote to memory of 2796	2580	92672e4250adfd02901825f3996d588a.exe	28
PID 2580 wrote to memory of 2796	2580	92672e4250adfd02901825f3996d588a.exe	28
PID 2580 wrote to memory of 2796	2580	92672e4250adfd02901825f3996d588a.exe	28
PID 2796 wrote to memory of 2708	2796	lqgmrby.exe	29
PID 2796 wrote to memory of 2708	2796	lqgmrby.exe	29
PID 2796 wrote to memory of 2708	2796	lqgmrby.exe	29
PID 2796 wrote to memory of 2708	2796	lqgmrby.exe	29
PID 2708 wrote to memory of 2784	2708	fwxhuyf.exe	30
PID 2708 wrote to memory of 2784	2708	fwxhuyf.exe	30
PID 2708 wrote to memory of 2784	2708	fwxhuyf.exe	30
PID 2708 wrote to memory of 2784	2708	fwxhuyf.exe	30
PID 2784 wrote to memory of 2268	2784	kbqpfis.exe	31
PID 2784 wrote to memory of 2268	2784	kbqpfis.exe	31
PID 2784 wrote to memory of 2268	2784	kbqpfis.exe	31
PID 2784 wrote to memory of 2268	2784	kbqpfis.exe	31
PID 2268 wrote to memory of 268	2268	vwravct.exe	32
PID 2268 wrote to memory of 268	2268	vwravct.exe	32
PID 2268 wrote to memory of 268	2268	vwravct.exe	32
PID 2268 wrote to memory of 268	2268	vwravct.exe	32
PID 268 wrote to memory of 2696	268	upssppd.exe	33
PID 268 wrote to memory of 2696	268	upssppd.exe	33
PID 268 wrote to memory of 2696	268	upssppd.exe	33
PID 268 wrote to memory of 2696	268	upssppd.exe	33
PID 2696 wrote to memory of 1244	2696	wkvvkpj.exe	34
PID 2696 wrote to memory of 1244	2696	wkvvkpj.exe	34
PID 2696 wrote to memory of 1244	2696	wkvvkpj.exe	34
PID 2696 wrote to memory of 1244	2696	wkvvkpj.exe	34
PID 1244 wrote to memory of 1936	1244	zgwnrks.exe	35
PID 1244 wrote to memory of 1936	1244	zgwnrks.exe	35
PID 1244 wrote to memory of 1936	1244	zgwnrks.exe	35
PID 1244 wrote to memory of 1936	1244	zgwnrks.exe	35
PID 1936 wrote to memory of 2144	1936	vkrfyzd.exe	36
PID 1936 wrote to memory of 2144	1936	vkrfyzd.exe	36
PID 1936 wrote to memory of 2144	1936	vkrfyzd.exe	36
PID 1936 wrote to memory of 2144	1936	vkrfyzd.exe	36
PID 2144 wrote to memory of 368	2144	amzaoxj.exe	37
PID 2144 wrote to memory of 368	2144	amzaoxj.exe	37
PID 2144 wrote to memory of 368	2144	amzaoxj.exe	37
PID 2144 wrote to memory of 368	2144	amzaoxj.exe	37
PID 368 wrote to memory of 816	368	cknqmcw.exe	38
PID 368 wrote to memory of 816	368	cknqmcw.exe	38
PID 368 wrote to memory of 816	368	cknqmcw.exe	38
PID 368 wrote to memory of 816	368	cknqmcw.exe	38
PID 816 wrote to memory of 1600	816	cwaibga.exe	39
PID 816 wrote to memory of 1600	816	cwaibga.exe	39
PID 816 wrote to memory of 1600	816	cwaibga.exe	39
PID 816 wrote to memory of 1600	816	cwaibga.exe	39
PID 1600 wrote to memory of 1636	1600	csmnxej.exe	40
PID 1600 wrote to memory of 1636	1600	csmnxej.exe	40
PID 1600 wrote to memory of 1636	1600	csmnxej.exe	40
PID 1600 wrote to memory of 1636	1600	csmnxej.exe	40
PID 1636 wrote to memory of 2092	1636	gffnrgw.exe	41
PID 1636 wrote to memory of 2092	1636	gffnrgw.exe	41
PID 1636 wrote to memory of 2092	1636	gffnrgw.exe	41
PID 1636 wrote to memory of 2092	1636	gffnrgw.exe	41

C:\Users\Admin\AppData\Local\Temp\92672e4250adfd02901825f3996d588a.exe
"C:\Users\Admin\AppData\Local\Temp\92672e4250adfd02901825f3996d588a.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\lqgmrby.exe
  C:\Windows\system32\lqgmrby.exe 484 "C:\Users\Admin\AppData\Local\Temp\92672e4250adfd02901825f3996d588a.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\fwxhuyf.exe
    C:\Windows\system32\fwxhuyf.exe 492 "C:\Windows\SysWOW64\lqgmrby.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\SysWOW64\kbqpfis.exe
      C:\Windows\system32\kbqpfis.exe 476 "C:\Windows\SysWOW64\fwxhuyf.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Writes to the Master Boot Record (MBR)
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2784
    - - C:\Windows\SysWOW64\vwravct.exe
        
        C:\Windows\system32\vwravct.exe 540 "C:\Windows\SysWOW64\kbqpfis.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2268
      - C:\Windows\SysWOW64\upssppd.exe
        
        C:\Windows\system32\upssppd.exe 544 "C:\Windows\SysWOW64\vwravct.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:268
        
        C:\Windows\SysWOW64\wkvvkpj.exe
        
        C:\Windows\system32\wkvvkpj.exe 452 "C:\Windows\SysWOW64\upssppd.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\zgwnrks.exe
        
        C:\Windows\system32\zgwnrks.exe 552 "C:\Windows\SysWOW64\wkvvkpj.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\vkrfyzd.exe
        
        C:\Windows\system32\vkrfyzd.exe 556 "C:\Windows\SysWOW64\zgwnrks.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\SysWOW64\amzaoxj.exe
        
        C:\Windows\system32\amzaoxj.exe 528 "C:\Windows\SysWOW64\vkrfyzd.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\cknqmcw.exe
        
        C:\Windows\system32\cknqmcw.exe 564 "C:\Windows\SysWOW64\amzaoxj.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\cwaibga.exe
        
        C:\Windows\system32\cwaibga.exe 568 "C:\Windows\SysWOW64\cknqmcw.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:816
        
        C:\Windows\SysWOW64\csmnxej.exe
        
        C:\Windows\system32\csmnxej.exe 572 "C:\Windows\SysWOW64\cwaibga.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\SysWOW64\gffnrgw.exe
        
        C:\Windows\system32\gffnrgw.exe 576 "C:\Windows\SysWOW64\csmnxej.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\vrdtupi.exe
        
        C:\Windows\system32\vrdtupi.exe 580 "C:\Windows\SysWOW64\gffnrgw.exe"
        15⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Modifies registry class
        
        PID:2092
        
        C:\Windows\SysWOW64\ybcqnlq.exe
        
        C:\Windows\system32\ybcqnlq.exe 456 "C:\Windows\SysWOW64\vrdtupi.exe"
        16⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\fiqihaa.exe
        
        C:\Windows\system32\fiqihaa.exe 588 "C:\Windows\SysWOW64\ybcqnlq.exe"
        17⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\fxnoyid.exe
        
        C:\Windows\system32\fxnoyid.exe 592 "C:\Windows\SysWOW64\fiqihaa.exe"
        18⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\mfbgkgm.exe
        
        C:\Windows\system32\mfbgkgm.exe 596 "C:\Windows\SysWOW64\fxnoyid.exe"
        19⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\mbnlpxv.exe
        
        C:\Windows\system32\mbnlpxv.exe 600 "C:\Windows\SysWOW64\mfbgkgm.exe"
        20⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\owqokxk.exe
        
        C:\Windows\system32\owqokxk.exe 604 "C:\Windows\SysWOW64\mbnlpxv.exe"
        21⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\qgpdctr.exe
        
        C:\Windows\system32\qgpdctr.exe 608 "C:\Windows\SysWOW64\owqokxk.exe"
        22⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\sqhbupz.exe
        
        C:\Windows\system32\sqhbupz.exe 612 "C:\Windows\SysWOW64\qgpdctr.exe"
        23⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\smtyrgi.exe
        
        C:\Windows\system32\smtyrgi.exe 460 "C:\Windows\SysWOW64\sqhbupz.exe"
        24⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\ctxwcfq.exe
        
        C:\Windows\system32\ctxwcfq.exe 620 "C:\Windows\SysWOW64\smtyrgi.exe"
        25⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\kmewqmt.exe
        
        C:\Windows\system32\kmewqmt.exe 624 "C:\Windows\SysWOW64\ctxwcfq.exe"
        26⤵
        
        PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ybcqnlq.exe

Path C:\Windows\SysWOW64\ybcqnlq.exe
Size 128KB
SHA256 9e90dbc1ff5ec21711875b30f51612d787ff10db0e4b938de9d58cd02a99a443
MD5 430d57dee1a5a330f7fd623c1a1cbf3a
SHA1 44f3b23a0ed62b2e38bc251eb0c1a92277fd15cb
SHA512 3f50ecddc8b486a16b31a0b2c77b63b4c1f6bf25d793cb2a278d3f555334ee7cd34543fe475862a3de347190d963d43ee7fcad2a75ad0be356ee4c2e9926a68d
SSDEEP 3072:fs+JRSfDZsPmqt/0ZRU0I64FNIZGenM5SEkZiboxX:UK0VsPXoRDaNItnM5Gz
MD5 SHA1 SHA512 SSDEEP

Submit Download

lqgmrby.exe

Path \Windows\SysWOW64\lqgmrby.exe
Size 253KB
SHA256 7918b15c30c95f9988f678cb41e531b5de016d23ad0a40c647144f42eadfa1fe
MD5 92672e4250adfd02901825f3996d588a
SHA1 d0ec70642a0b576358c24a80994054a4727f2c5a
SHA512 833340ebb88fb23e07fb0b229744fdf6705b1405441c9d926f587dab1d838f0208df244c23fe0bca156999526bd4add17e691379bd581093c48f9a8c47f02eb4
SSDEEP 6144:UK0VsPXoRDaNItnM5GEJFwvP6bQ7yMP+DE827c23EOca:euoROIukSm6b7MP+Dd2FEOca
MD5 SHA1 SHA512 SSDEEP

Submit Download

ybcqnlq.exe

Path \Windows\SysWOW64\ybcqnlq.exe
Size 192KB
SHA256 fccd96177ee7120530a0a7738af7185d8e893d05fa3baee011b6f983d87b3414
MD5 6ed4d66330204960ffc9fe7cee505291
SHA1 529b120784510e2fa7330e15586b013d83d691a7
SHA512 c82b8d6bbd7c241228aeb75a3cac6d15d34ced0544381f81312e7cf18744b22546b9d8e1071f143942912b1c5ba57a85e55d31b9dbec97abd9cb8c75a07c12f7
SSDEEP 3072:fs+JRSfDZsPmqt/0ZRU0I64FNIZGenM5SEkZiboxWSgJlbbrMbvT0q8O1cZPzQ7H:UK0VsPXoRDaNItnM5GEJFwvP6bQ7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/268-145-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/368-218-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/816-230-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/1244-182-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/1584-286-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/1600-243-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/1636-253-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/1936-194-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/1980-280-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2092-266-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2112-326-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2144-205-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2148-336-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2268-133-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2580-51-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/2580-59-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Download

memory/2580-20-0x0000000000550000-0x0000000000551000-memory.dmp

Download

memory/2580-19-0x0000000000520000-0x0000000000521000-memory.dmp

Download

memory/2580-18-0x0000000000530000-0x0000000000531000-memory.dmp

Download

memory/2580-17-0x00000000003E0000-0x00000000003E1000-memory.dmp

Download

memory/2580-16-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/2580-15-0x00000000003C0000-0x00000000003C1000-memory.dmp

Download

memory/2580-14-0x00000000003D0000-0x00000000003D1000-memory.dmp

Download

memory/2580-13-0x0000000000320000-0x0000000000321000-memory.dmp

Download

memory/2580-12-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/2580-11-0x0000000000300000-0x0000000000301000-memory.dmp

Download

memory/2580-10-0x0000000000310000-0x0000000000311000-memory.dmp

Download

memory/2580-8-0x00000000002E0000-0x00000000002E1000-memory.dmp

Download

memory/2580-7-0x00000000002A0000-0x00000000002A1000-memory.dmp

Download

memory/2580-6-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2580-5-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2580-4-0x0000000000290000-0x0000000000291000-memory.dmp

Download

memory/2580-3-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/2580-2-0x0000000000280000-0x0000000000286000-memory.dmp

Download

memory/2580-37-0x00000000005F0000-0x00000000005F1000-memory.dmp

Download

memory/2580-42-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/2580-54-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/2580-22-0x0000000000570000-0x0000000000571000-memory.dmp

Download

memory/2580-55-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Download

memory/2580-53-0x0000000002A60000-0x0000000002A61000-memory.dmp

Download

memory/2580-52-0x0000000002A30000-0x0000000002A31000-memory.dmp

Download

memory/2580-0-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2580-50-0x0000000002930000-0x0000000002931000-memory.dmp

Download

memory/2580-49-0x0000000002940000-0x0000000002941000-memory.dmp

Download

memory/2580-48-0x0000000002910000-0x0000000002911000-memory.dmp

Download

memory/2580-57-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Download

memory/2580-47-0x0000000002920000-0x0000000002921000-memory.dmp

Download

memory/2580-63-0x0000000002A40000-0x0000000002A41000-memory.dmp

Download

memory/2580-62-0x0000000002A20000-0x0000000002A21000-memory.dmp

Download

memory/2580-61-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Download

memory/2580-60-0x0000000002D00000-0x0000000002D01000-memory.dmp

Download

memory/2580-21-0x0000000000540000-0x0000000000541000-memory.dmp

Download

memory/2580-58-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Download

memory/2580-46-0x00000000028F0000-0x00000000028F1000-memory.dmp

Download

memory/2580-45-0x0000000002900000-0x0000000002901000-memory.dmp

Download

memory/2580-44-0x00000000028D0000-0x00000000028D1000-memory.dmp

Download

memory/2580-43-0x00000000028E0000-0x00000000028E1000-memory.dmp

Download

memory/2580-64-0x0000000002D10000-0x0000000002E2B000-memory.dmp

Download

memory/2580-39-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/2580-71-0x0000000002D10000-0x0000000002E2B000-memory.dmp

Download

memory/2580-1-0x0000000000250000-0x0000000000280000-memory.dmp

Download

memory/2580-73-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2580-9-0x00000000002D0000-0x00000000002D1000-memory.dmp

Download

memory/2580-36-0x0000000002490000-0x0000000002491000-memory.dmp

Download

memory/2580-35-0x00000000024A0000-0x00000000024A1000-memory.dmp

Download

memory/2580-23-0x0000000000560000-0x0000000000561000-memory.dmp

Download

memory/2580-24-0x0000000000590000-0x0000000000591000-memory.dmp

Download

memory/2580-34-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download

memory/2580-25-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/2580-26-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/2580-27-0x0000000000650000-0x0000000000651000-memory.dmp

Download

memory/2580-28-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/2580-29-0x0000000000670000-0x0000000000671000-memory.dmp

Download

memory/2580-30-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/2580-31-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/2580-32-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/2580-33-0x0000000002480000-0x0000000002481000-memory.dmp

Download

memory/2608-318-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2652-344-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2696-170-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2708-110-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2756-302-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2784-124-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2796-100-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2796-72-0x0000000000250000-0x0000000000280000-memory.dmp

Download

memory/2828-294-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2888-312-0x0000000000400000-0x000000000051B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads