31223aada436a65b0132a24be6552ca3247f68453fc138f14aef123673310200

General

Target

ce2aa4911d9b04f41b0da2402b9f75cd.exe
Size

280KB
MD5

ce2aa4911d9b04f41b0da2402b9f75cd
SHA1

6fee1e28505a3eb111f5da6400302e98b28b3a23
SHA256

31223aada436a65b0132a24be6552ca3247f68453fc138f14aef123673310200
SHA512

9b413b5f186a609f59abd6c90def422f3ff2bc441589c2ef82d4214199ab7fcc555b660b7586a355553ef7b0d3d58e6e117057ebf72858284d73c377cc87e0e5
SSDEEP

6144:/ndMpmHkIsaazmhNITeD6uXy92NgvpnoJtEhU:/yp4kiGmhNweeYy2anwWh

Score

7^/10

aspackv2 bootkit persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000c000000012248-10.dat	aspack_v212_v242

Executes dropped EXE 3 IoCs

pid	Process
3012	DERVSER.com
2872	netvster.exe
2540	netcmd.scr

Loads dropped DLL 10 IoCs

pid	Process
2232	ce2aa4911d9b04f41b0da2402b9f75cd.exe
2232	ce2aa4911d9b04f41b0da2402b9f75cd.exe
2232	ce2aa4911d9b04f41b0da2402b9f75cd.exe
2232	ce2aa4911d9b04f41b0da2402b9f75cd.exe
2872	netvster.exe
2872	netvster.exe
2408	WerFault.exe
2408	WerFault.exe
2408	WerFault.exe
2408	WerFault.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ce2aa4911d9b04f41b0da2402b9f75cd.exe
File opened for modification	\??\PhysicalDrive0	netvster.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\PLUGINS\coner.bat	netvster.exe
File created	C:\Program Files\Internet Explorer\PLUGINS\netcmd.scr	netvster.exe
File created	C:\Program Files\Internet Explorer\PLUGINS\icwxcb.dun	netvster.exe
File created	C:\Program Files\Internet Explorer\PLUGINS\icwnet.icw	netvster.exe
File created	C:\Program Files\Internet Explorer\PLUGINS\vreg.reg	netvster.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	2540	WerFault.exe	32

Runs .reg file with regedit 1 IoCs

pid	Process
2504	regedit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	DERVSER.com

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 3012	2232	ce2aa4911d9b04f41b0da2402b9f75cd.exe	28
PID 2232 wrote to memory of 3012	2232	ce2aa4911d9b04f41b0da2402b9f75cd.exe	28
PID 2232 wrote to memory of 3012	2232	ce2aa4911d9b04f41b0da2402b9f75cd.exe	28
PID 2232 wrote to memory of 3012	2232	ce2aa4911d9b04f41b0da2402b9f75cd.exe	28
PID 2232 wrote to memory of 2872	2232	ce2aa4911d9b04f41b0da2402b9f75cd.exe	29
PID 2232 wrote to memory of 2872	2232	ce2aa4911d9b04f41b0da2402b9f75cd.exe	29
PID 2232 wrote to memory of 2872	2232	ce2aa4911d9b04f41b0da2402b9f75cd.exe	29
PID 2232 wrote to memory of 2872	2232	ce2aa4911d9b04f41b0da2402b9f75cd.exe	29
PID 2872 wrote to memory of 2260	2872	netvster.exe	30
PID 2872 wrote to memory of 2260	2872	netvster.exe	30
PID 2872 wrote to memory of 2260	2872	netvster.exe	30
PID 2872 wrote to memory of 2260	2872	netvster.exe	30
PID 2872 wrote to memory of 2540	2872	netvster.exe	32
PID 2872 wrote to memory of 2540	2872	netvster.exe	32
PID 2872 wrote to memory of 2540	2872	netvster.exe	32
PID 2872 wrote to memory of 2540	2872	netvster.exe	32
PID 2260 wrote to memory of 2504	2260	cmd.exe	33
PID 2260 wrote to memory of 2504	2260	cmd.exe	33
PID 2260 wrote to memory of 2504	2260	cmd.exe	33
PID 2260 wrote to memory of 2504	2260	cmd.exe	33
PID 2540 wrote to memory of 2408	2540	netcmd.scr	34
PID 2540 wrote to memory of 2408	2540	netcmd.scr	34
PID 2540 wrote to memory of 2408	2540	netcmd.scr	34
PID 2540 wrote to memory of 2408	2540	netcmd.scr	34

C:\Users\Admin\AppData\Local\Temp\ce2aa4911d9b04f41b0da2402b9f75cd.exe
"C:\Users\Admin\AppData\Local\Temp\ce2aa4911d9b04f41b0da2402b9f75cd.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\DERVSER.com
  "C:\Users\Admin\AppData\Local\Temp\DERVSER.com"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\netvster.exe
  "C:\Users\Admin\AppData\Local\Temp\netvster.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Program Files\Internet Explorer\PLUGINS\coner.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s vreg.reg
      4⤵
      Runs .reg file with regedit
      PID:2504
- - C:\Program Files\Internet Explorer\PLUGINS\netcmd.scr
    "C:\Program Files\Internet Explorer\PLUGINS\netcmd.scr" /S
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 120
      4⤵
      Loads dropped DLL
      Program crash
      PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Internet Explorer\PLUGINS\coner.bat

Filesize
42B

MD5
d4f6133a574af24c7393b0be3f9574dc

SHA1
e85cfcac0b02de185a78423a72dea159a562d8db

SHA256
c2c98aa46c21545bdd73367e33b6567c116bec0dea57522f51aec08461a9f86a

SHA512
d7b5da341f3ce0a70ed8879e0032afa79c9f8bf31d2bcec3803601275affea9550434ebea58c29c7bf1cb17f9bf67fa2de2927d7e2403e2f72ad88e61af3fba5

Download Submit
C:\Program Files\Internet Explorer\PLUGINS\vreg.reg

Filesize
346B

MD5
821a54b83bf9a520c7d1d25d74617322

SHA1
56d2dbcdc8ef78c4bd33229c0747f27e734073db

SHA256
96cf2a16bdf281109b1879cf59616a6ef62a456ed26663ece04609d593845c26

SHA512
4d568db2493e4c39c7fb1c1f6f71d0b0af46377701ce90460f8b5939ca12aa25302f9f06f81657316560b28c2955105c93b290e6ab67b27155c8f2cc60af0ee5

Download Submit
\Program Files\Internet Explorer\PLUGINS\netcmd.scr

Filesize
35KB

MD5
65f59648a0907c75f987a8796db8da1d

SHA1
93d1c786c0e4a7b3d01d60a2c984fbfbf82d0705

SHA256
f72a1e90d1680da02b1295f6cc24a6a5371f961cdea10925c5af4a1bf971676e

SHA512
c2d96e438d7d96c3cd456e4b42ae19a17749adeedc8f6c09f87bb7363449f7a02f1cc8b8d8989f2807084f94f78e68bb795512f84cd7bd1a0630a4ec22ae0699

Download Submit
\Users\Admin\AppData\Local\Temp\DERVSER.com

Filesize
48KB

MD5
a8cae310dba683aa7ec4f9f08a00957e

SHA1
4167041bae839ea30176d9b13ea64b4d030d232f

SHA256
3c38d603b0c7f704d7975d64ab705f1e8bde4805e0596de2c98636eed2333c10

SHA512
14a28a222124dcac43bb3e7ea0959be5a1afc77d737337ae27a0e7d87d32b3c9e6abe36c8872614b0d7b10e4ab4f241a3b1e29fed83879e4c9e6e5bbf6f8f901

Download Submit
\Users\Admin\AppData\Local\Temp\netvster.exe

Filesize
131KB

MD5
c847a5f03b936aa2765eedd6872ca49a

SHA1
eb6c0e4f52c1c8f947f8d01ea59c498a8ecb5533

SHA256
e8e6957a95baaaf0aea514965968cb64850bd4187ce834a453aa3442bec9ae5c

SHA512
2179cc06c1dcb313edba5eb1b3537c86580a817983061654e5bddae2937be572e15e384f1bdfdd18a4134ff24b8fa818efac8f56813ae51f44e58b8830889c55

Download Submit
memory/2232-29-0x0000000002900000-0x0000000002928000-memory.dmp

Filesize
160KB

Download
memory/2232-23-0x0000000002900000-0x0000000002928000-memory.dmp

Filesize
160KB

Download
memory/2232-2-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2232-5-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2232-12-0x0000000002900000-0x0000000002912000-memory.dmp

Filesize
72KB

Download
memory/2232-18-0x0000000002900000-0x0000000002912000-memory.dmp

Filesize
72KB

Download
memory/2232-6-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2232-28-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2232-1-0x0000000000310000-0x000000000034A000-memory.dmp

Filesize
232KB

Download
memory/2232-8-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2232-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2232-31-0x0000000000310000-0x000000000034A000-memory.dmp

Filesize
232KB

Download
memory/2232-7-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2232-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2872-35-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2872-33-0x00000000002E0000-0x000000000031A000-memory.dmp

Filesize
232KB

Download
memory/2872-36-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2872-37-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2872-38-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/2872-40-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/2872-42-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2872-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2872-41-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/3012-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3012-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads