05f9a6b8d512fc86ad39a503a4b82385b04b274c10d8260135d3babeefa8abea

Analysis

max time kernel
28s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BoosterX2.0.rar
Size 9.1MB
Sample240302-sc86haef93
SHA256 05f9a6b8d512fc86ad39a503a4b82385b04b274c10d8260135d3babeefa8abea
MD5 30f16376b4d940673d31ef43a40adf98
SHA1 5aa69c1e1928d41539dc2b6900a2fd223b6eaba9
SHA512 600807d81457108379ec500c289de93069f1a4b5242110576e5f5502caf0f1b2661ba7f4c9de7dd5066cf3f82a7730054bf3189aac8813727952824564a83139
SSDEEP 196608:6cuGDnBvSyJBhmSo4zYvp9KlTKHUZwkD5XCDnnIIQVUOyxokK:6RGDnBvBO4cKKUmkDQTIIQVey9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

pyinstaller

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2440	BoosterX2.0.exe
2620	BoosterX2.0.exe

Loads dropped DLL 6 IoCs

pid	Process
1192	Process not Found
1192	Process not Found
1192	Process not Found
2620	BoosterX2.0.exe
1192	Process not Found
1192	Process not Found

Detects Pyinstaller 7 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x002e000000014698-27.dat	pyinstaller
behavioral1/files/0x002e000000014698-26.dat	pyinstaller
behavioral1/files/0x002e000000014698-28.dat	pyinstaller
behavioral1/files/0x002e000000014698-29.dat	pyinstaller
behavioral1/files/0x002e000000014698-30.dat	pyinstaller
behavioral1/files/0x002e000000014698-43.dat	pyinstaller
behavioral1/files/0x002e000000014698-47.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2564	7zFM.exe
Token: 35	2564	7zFM.exe
Token: SeSecurityPrivilege	2564	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2564	7zFM.exe
2564	7zFM.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2564	3008	cmd.exe	29
PID 3008 wrote to memory of 2564	3008	cmd.exe	29
PID 3008 wrote to memory of 2564	3008	cmd.exe	29
PID 2440 wrote to memory of 2620	2440	BoosterX2.0.exe	32
PID 2440 wrote to memory of 2620	2440	BoosterX2.0.exe	32
PID 2440 wrote to memory of 2620	2440	BoosterX2.0.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\BoosterX2.0.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\BoosterX2.0.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2564

C:\Users\Admin\Desktop\BoosterX2.0.exe
"C:\Users\Admin\Desktop\BoosterX2.0.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\Desktop\BoosterX2.0.exe
  "C:\Users\Admin\Desktop\BoosterX2.0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\python312.dll
Size 3.8MB
SHA256 e26951c8317cccac89ffa6f6965156587e8583598f5568120a2b708ab3911eb0
MD5 2118085d99f6ba25f65c5c2a69f94aa0
SHA1 9c334c50fda85c4886447a0e3f3e584c266d72a3
SHA512 4b20cdaed3633cb8a7f04ac1039d37bfcd3f5afdf1f5a8e8741d4efe16576c23b1f6df928778ab17c6fd3c59bf8df7469d81622f571bc9f4e4f9434b71ec8761
SSDEEP 49152:Uit0mhL3kezRzRaIa7dsmtY1gBmHJISS0BXEXjMUPJph+GMg4bK1ZYMxPQrq0w6l:B6vwRS7fYzmSSVlLWyJVT7OQvxHDW
MD5 SHA1 SHA512 SSDEEP

Submit Download

BoosterX2.0.exe

Path C:\Users\Admin\Desktop\BoosterX2.0.exe
Size 4.3MB
SHA256 6ebd1ef749439472be0f5a8a2e19c4a84f6e18a147ce9d9aa4c774b0de227ea4
MD5 7ef68538ad8a2f054b66d8d387b26f0a
SHA1 d4282f2be762a2199ee586946580593cac484905
SHA512 f66347699d8a278a8ad5e9fe33837b03c002c649acdf88effe5e233e5780466ed33530b85e2bf38e607c59fc5b83eac4f261b41d7e28d7bc40a9ab5515a7ea59
SSDEEP 98304:zVT2+ZAr2KpshRW5boUdM5jIp0Bbl6qzBcklyc1W903z:zV6+ZAr3pGRgb7y5jIexH1W903z
MD5 SHA1 SHA512 SSDEEP

Submit Download

BoosterX2.0.exe

Path C:\Users\Admin\Desktop\BoosterX2.0.exe
Size 4.4MB
SHA256 ba7c1f8378b0a6ab23508c4a31df7f4eb1748a93938b46a9e192812c3adfcfa4
MD5 a6cde38a78d1b2169995abef51876ad4
SHA1 7a1783df73c42c20105d72d13916c6f74c0f8a4b
SHA512 5ccbb20aa3499950eeb9074b4cacdcaec23afcbc67a9cb7d3a244c6a99b075f7c62f626d83192a7ba46850765c4f0f246ee7f66271a756e1b782512b23793859
SSDEEP 98304:zVT2+ZAr2KpshRW5boUdM5jIp0Bbl6qzBcklyc1W903Am:zV6+ZAr3pGRgb7y5jIexH1W903N
MD5 SHA1 SHA512 SSDEEP

Submit Download

BoosterX2.0.exe

Path C:\Users\Admin\Desktop\BoosterX2.0.exe
Size 4.1MB
SHA256 626ff50801b81fe4a60def0fb568270870cd4fb2a84bc0f0054ffad98b4d8594
MD5 10ac374b85e030128277c725b0de31f5
SHA1 82b6243788ba39511ad7dae94836ecb24065efcc
SHA512 f2d64395a02dacb871dfa1aac38f08576e4e6b8cd1f75549758fe6fea08054775e9f9650b7abde4de15616dbf15db72129eaa651cbfef56a906b564dd3019d00
SSDEEP 98304:zVT2+ZAr2KpshRW5boUdM5jIp0Bbl6qzBcklyc1W9F:zV6+ZAr3pGRgb7y5jIexH1W9F
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path \Users\Admin\AppData\Local\Temp\_MEI24402\python312.dll
Size 2.9MB
SHA256 e489a0dfeac4e0de748851ba2aa694f2694500aee56ba2dd9f71f8845afe25a9
MD5 2811693d4b8b44e3507a5de2079b8913
SHA1 f0a2fa8897fa219e35aa8437b095af77952d2b76
SHA512 89a5afdccd5aedd00f7ecba642a4332cc04a9c69fc5419de785a74e7ed991d62b65f374c063b87d0b1ccf442ebfeb6829fa0f3e65d5472bd690cb0dccaeb0f4e
SSDEEP 49152:Uit0mhL3kezRzRaIa7dsmtY1gBmHJISS0BXEXjMUPJph+GMg4bK1ZYMxPQrq0w6f:B6vwRS7fYzmSSVlLWyJVT7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

BoosterX2.0.exe

Path \Users\Admin\Desktop\BoosterX2.0.exe
Size 576KB
SHA256 7130525ccf11fab69379ba906390ddc42b2c60ee25c2ae8f9925cd39cd343598
MD5 249c01faddf30311232c0166186b8c42
SHA1 291712b0f128a6f12a9a4bccc249cc141983aa25
SHA512 f3887898eb357aa58789628f85b5c2e6ead7fae9173f7c481ef486a8ec7e4df36ae9f5329d9bc58f67da35f56bf3e6b46b7aec5ec9c92dcf0cb2e29b9c06689f
SSDEEP 12288:7XDpMTuHgXcaCIV9mdgnqa1ID2P9mTitjO2f15LbC6:bDAFXcbIpnqa1C2ETSjvf+6
MD5 SHA1 SHA512 SSDEEP

Submit Download

BoosterX2.0.exe

Path \Users\Admin\Desktop\BoosterX2.0.exe
Size 510KB
SHA256 8e8803e4432678b23ae76bd024cba3e42f1df0f98411f83df0c380be87faa428
MD5 4ae7247c9e70e5d74c8ca2a183e3f59a
SHA1 f902ab5a5b76e054c49874381e3119edbed18e21
SHA512 4947a8aaeb814c734d00ff3e269d73afc800a299a8d33b4d2fc3f393b862a9ee6872d4b0208f4207c90fa0952524c4109409bb424801677bd4ad52cf52b1d6eb
SSDEEP 12288:7XDpMTuHgXcaCIV9mdgnqa1ID2P9mTitjO2f12:bDAFXcbIpnqa1C2ETSjvfM
MD5 SHA1 SHA512 SSDEEP

Submit Download

BoosterX2.0.exe

Path \Users\Admin\Desktop\BoosterX2.0.exe
Size 320KB
SHA256 df1fca791964fe539b7331d5c8fe2dfc336a5cea0d7bb68ccd5de75fd4fcc411
MD5 867d652f14d886a701d8af1ff6fcce65
SHA1 171190db8e1bec5b9e30d111bdb8e46aa6ed59eb
SHA512 ef83ac2d75fbc42a758e04b7e65965bdb0bd2a3f190d46f8f556a0c994ef45bfb9060fa54155bde1c97e5c365335d678b40e32a61e4b983c551f2e8f0fdae872
SSDEEP 6144:7Di8z3pMagu/vgXSNaCkxGdqkJNfHWE3FCGdgnqwGnmXrHVnI6:7XDpMTuHgXcaCIV9mdgnqa1I6
MD5 SHA1 SHA512 SSDEEP

Submit Download

BoosterX2.0.exe

Path \Users\Admin\Desktop\BoosterX2.0.exe
Size 4.0MB
SHA256 43e7893ba6c6e2120f34872c85cbf6bb13ae263582aa6154cc442cc9901965a1
MD5 f0ba66a08b88397ddb166dbefaedff7a
SHA1 16b89f9c4efdad190c0c96359ac7d0fce5d1be34
SHA512 70c89e6fc3662342fbabb0d5d8f19d5ac72a045c5bca3086975cf62cbebf893d2de086f843ecd200af965bab809b7059939df8ecbc86f30c21f97d59376597a8
SSDEEP 98304:zVT2+ZAr2KpshRW5boUdM5jIp0Bbl6qzBcklyc1W9P:zV6+ZAr3pGRgb7y5jIexH1W9P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads