Analysis
-
max time kernel
186s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/03/2024, 11:58
General
-
Target
be8cfc2526efcc21da279e97faac0ccd.exe
-
Size
1.8MB
-
MD5
be8cfc2526efcc21da279e97faac0ccd
-
SHA1
cde7dc54797056c2afcb852fa178db49fa529657
-
SHA256
5557bc2b4439f7e348cc30dfab22714f051296d8906691256d1280715cb40825
-
SHA512
5951360882c7790700d6907dc9915f181f9446538cb44c03a59f0cf45b53d85a1ad05293b4b4c24c59771fe73fb6f1e0134968c640db8db3f610da3fe1f00bed
-
SSDEEP
49152:RMumM6xRN9GfpB9EbWMVjHg9/chd/ww1vQr/wi6LfUwRD:qZRSfprEW/0zisLtRD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\be8cfc2526efcc21da279e97faac0ccd.exe"C:\Users\Admin\AppData\Local\Temp\be8cfc2526efcc21da279e97faac0ccd.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mang2\ddqjh_wqeqd.exe"C:\Users\Admin\AppData\Roaming\mang2\ddqjh_wqeqd.exe" /setupsucc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
10KB
MD556a321bd011112ec5d8a32b2f6fd3231
SHA1df20e3a35a1636de64df5290ae5e4e7572447f78
SHA256bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
SHA5125354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
-
Filesize
1.6MB
MD586d6bdfc762e0eb60606d8c227a9a50b
SHA10eb0f7cbceed4ba18be76108be2480693cb94d0c
SHA25609a6579d86a8d7627229e336f846cfc71f5d76f0c5be92ee4125be719f659530
SHA5124e83cf8ac1bd38058dd0d45e09282edf284f98639c7e25f70e69a3ac8686c585dfde6389ddb2c6617b0d102d6f9845817b565593ab61b8ff91c733aafe7b11a5
-
Filesize
363B
MD5917ec9d7b3a7a0ad3e2ba8ef7e1c6668
SHA1abed79adcd3a1e3db705fb2bdc6eddafb5f06e22
SHA256d3897767261d7bdf9b3044189d66f2d554792d59650d12c46b3423e179e34c38
SHA5123e07438e858b100e7255a8926927ea8cd716777e4f76a197c3c204982652b8ef8a1e69f2c804ed0dfea27f62ce4e96b8bd7b5ff2849bde25a0b22b9648680552
-
Filesize
414B
MD5fafd2f3bc4855c1ab5f2f32cac1a8ffe
SHA1abfcdedbca4af008ff1441244783001edca4812e
SHA256562ec99a5273e0bae5a73571d4d9a23df676876b1ac70fcc76a814a96b4610e3
SHA5120b808ac32a581fa47ec55a9ad5fb82d307836a0471060e270dabdc8ccb12e1cc9c5161d5d8fee20c119871c503ac958c8b151df1a32cd76ab67ed7edca14cb2a
-
Filesize
31KB
MD5c35a26f177a905feb02adbb2d7db5c00
SHA170f5a756fa020fedad901014206f4069cdd024c3
SHA256362a34664946a5fe654fe5f3286392d88c256962a1a0dc4342dc4fd0db47f299
SHA51279c62acc778f131ae4ab070c309a4452c2d84b22b06ca499e5bf158a80aff20f0c1fcbb810374f8c1b9b8314aecc52f7818e7a241d354c0675ac2e73e8c233c1
-
Filesize
3KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
3KB
-
Filesize
12KB
-
Filesize
3KB
-
Filesize
3KB