120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b

General

Target

120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.exe
Size

403KB
MD5

1581bd35e4f16dca4b982a2b953cfcdd
SHA1

a6252f7993137811caca25634674ced6b126c3b9
SHA256

120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b
SHA512

31bc1f323d471177a502f508a698d08abae7777c2cab54d31a8c5f6b25cc2a9018a4d3238720c82d5ba8bac6dbd4b2f4c8bba3f73175b9f5be6ceccad35bd43c
SSDEEP

6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4:gtRfJcNYFNm8UhlZGse

Score

8^/10

bootkit persistence spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
3	2548	rundll32.exe
5	2548	rundll32.exe
8	2548	rundll32.exe
9	2548	rundll32.exe
10	2548	rundll32.exe
13	2548	rundll32.exe
14	2548	rundll32.exe
15	2548	rundll32.exe
17	2548	rundll32.exe
18	2548	rundll32.exe

Deletes itself 1 IoCs

Processes:

zyqyoa.exe

pid process

2652 zyqyoa.exe
Executes dropped EXE 1 IoCs

Processes:

zyqyoa.exe

pid process

2652 zyqyoa.exe
Loads dropped DLL 6 IoCs

Processes:

cmd.exerundll32.exe

pid process

2668 cmd.exe
2668 cmd.exe
2548 rundll32.exe
2548 rundll32.exe
2548 rundll32.exe
2548 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2652	zyqyoa.exe

pid	process
2652	zyqyoa.exe

pid	process
2668	cmd.exe
2668	cmd.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\bppvemf\\oovls.dll\",Verify"	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
File opened (read-only)	\??\g:	rundll32.exe
File opened (read-only)	\??\p:	rundll32.exe
File opened (read-only)	\??\r:	rundll32.exe
File opened (read-only)	\??\v:	rundll32.exe
File opened (read-only)	\??\z:	rundll32.exe
File opened (read-only)	\??\e:	rundll32.exe
File opened (read-only)	\??\j:	rundll32.exe
File opened (read-only)	\??\k:	rundll32.exe
File opened (read-only)	\??\o:	rundll32.exe
File opened (read-only)	\??\q:	rundll32.exe
File opened (read-only)	\??\s:	rundll32.exe
File opened (read-only)	\??\y:	rundll32.exe
File opened (read-only)	\??\h:	rundll32.exe
File opened (read-only)	\??\i:	rundll32.exe
File opened (read-only)	\??\l:	rundll32.exe
File opened (read-only)	\??\m:	rundll32.exe
File opened (read-only)	\??\u:	rundll32.exe
File opened (read-only)	\??\w:	rundll32.exe
File opened (read-only)	\??\x:	rundll32.exe
File opened (read-only)	\??\a:	rundll32.exe
File opened (read-only)	\??\b:	rundll32.exe
File opened (read-only)	\??\n:	rundll32.exe
File opened (read-only)	\??\t:	rundll32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 rundll32.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

2548 rundll32.exe
Drops file in Program Files directory 2 IoCs

Processes:

zyqyoa.exe

description ioc process

File opened for modification \??\c:\Program Files\bppvemf zyqyoa.exe
File created \??\c:\Program Files\bppvemf\oovls.dll zyqyoa.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	rundll32.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\bppvemf	zyqyoa.exe
File created	\??\c:\Program Files\bppvemf\oovls.dll	zyqyoa.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1456 PING.EXE

pid	process
1456	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 2548 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.exezyqyoa.exe

pid process

1284 120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.exe
2652 zyqyoa.exe

description	pid	process
Token: SeDebugPrivilege	2548	rundll32.exe

pid	process
1284	120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.exe
2652	zyqyoa.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.execmd.exezyqyoa.exe

description	pid	process	target process
PID 1284 wrote to memory of 2668	1284	120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.exe	cmd.exe
PID 1284 wrote to memory of 2668	1284	120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.exe	cmd.exe
PID 1284 wrote to memory of 2668	1284	120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.exe	cmd.exe
PID 1284 wrote to memory of 2668	1284	120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.exe	cmd.exe
PID 2668 wrote to memory of 1456	2668	cmd.exe	PING.EXE
PID 2668 wrote to memory of 1456	2668	cmd.exe	PING.EXE
PID 2668 wrote to memory of 1456	2668	cmd.exe	PING.EXE
PID 2668 wrote to memory of 1456	2668	cmd.exe	PING.EXE
PID 2668 wrote to memory of 2652	2668	cmd.exe	zyqyoa.exe
PID 2668 wrote to memory of 2652	2668	cmd.exe	zyqyoa.exe
PID 2668 wrote to memory of 2652	2668	cmd.exe	zyqyoa.exe
PID 2668 wrote to memory of 2652	2668	cmd.exe	zyqyoa.exe
PID 2652 wrote to memory of 2548	2652	zyqyoa.exe	rundll32.exe
PID 2652 wrote to memory of 2548	2652	zyqyoa.exe	rundll32.exe
PID 2652 wrote to memory of 2548	2652	zyqyoa.exe	rundll32.exe
PID 2652 wrote to memory of 2548	2652	zyqyoa.exe	rundll32.exe
PID 2652 wrote to memory of 2548	2652	zyqyoa.exe	rundll32.exe
PID 2652 wrote to memory of 2548	2652	zyqyoa.exe	rundll32.exe
PID 2652 wrote to memory of 2548	2652	zyqyoa.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.exe
"C:\Users\Admin\AppData\Local\Temp\120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\zyqyoa.exe "C:\Users\Admin\AppData\Local\Temp\120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
3⤵
- Runs ping.exe
PID:1456

C:\Users\Admin\AppData\Local\Temp\zyqyoa.exe
C:\Users\Admin\AppData\Local\Temp\\zyqyoa.exe "C:\Users\Admin\AppData\Local\Temp\120a0efd4e4eea95fe3c6730fb495bc1006b33081a9a107619df1f16595b138b.exe"
3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652

\??\c:\windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.exe "c:\Program Files\bppvemf\oovls.dll",Verify C:\Users\Admin\AppData\Local\Temp\zyqyoa.exe
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\bppvemf\oovls.dll
Filesize
228KB

MD5
31278c038a76f5896572d0d31849b888

SHA1
7478f0bf50e2a0dd7e46c4cc3a30a853aa447a1f

SHA256
9fb825e418ad7d65fa46df30031fda94d348ade10efd05f408d15e0bf7dddc2a

SHA512
8642cb61469bf7452d6cdd2924b03333352a83394be445475c6eda8af30167ba21c797a76f53ee35feec3e4e7d6137fd1947ba1ef954422c3bf8880852a9ed2b

Download Submit
\Users\Admin\AppData\Local\Temp\zyqyoa.exe
Filesize
403KB

MD5
f75583aea849b0a07f31ce559a55e222

SHA1
afc36f582dbf74604e264f5a76f9d8c8c3cf0606

SHA256
21471fc49ee9bf56fb5ee40fc0f38687f4b77ed3f3a7243828a5c7d8fbed1ef5

SHA512
509ca2b6237499a12ebee9609ead58112788974d9d1cf464c8dfaf3f0a0648111268b5082668e006954faaca96d55b4f1b4d20bc47c09051be2b4eea71ce4375

Download Submit
memory/1284-2-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1284-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2548-19-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/2548-18-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/2548-17-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/2548-16-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/2548-20-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/2548-22-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/2652-10-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2652-8-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2668-4-0x0000000000120000-0x0000000000184000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads