e197e28bd08c56c2ab5abc663ce11d56221bacdda99305e1cdb614300340d5e3

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$APPDATA/Microsoft/Internet Explorer/Quick Launch/softmaster.exe
Size 5.0MB
Sample240507-nzeg7aee8t
SHA256 67f5fb161125e9a6d412dcfa1431bec874bfa001f0ac3645bf5bca393ff48340
MD5 896bc886d1f71a8dfaacffb4d45d381d
SHA1 d263eee85b5cf09787bce4a46069ee729ff4b571
SHA512 1d0f49f9805d329f3806fac6827a52b0a28aafc4d82f43ad28a0f82d4287855950c8976a21be8d00a2bfd490e3e83a1079f3808fa3f16935600656bcb7c36e56
SSDEEP 98304:KizXZH0pyu4HoagLht2ZEM47n+jEtLk4+7DOSOWHBN:K8Jbsk947nsuQ4+7DO0X
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit discovery persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral25/memory/2012-57-0x0000000073770000-0x000000007380D000-memory.dmp	upx
behavioral25/memory/2012-58-0x0000000073770000-0x000000007380D000-memory.dmp	upx
behavioral25/memory/2012-63-0x0000000073770000-0x000000007380D000-memory.dmp	upx
behavioral25/memory/2012-71-0x0000000073770000-0x000000007380D000-memory.dmp	upx
behavioral25/memory/2012-72-0x0000000073770000-0x000000007380D000-memory.dmp	upx
behavioral25/memory/2012-106-0x0000000073770000-0x000000007380D000-memory.dmp	upx
behavioral25/memory/2012-107-0x0000000073770000-0x000000007380D000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	softmaster.exe
File opened for modification	\??\PhysicalDrive0	rmup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	softmaster.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.03062\displayicon.ico	softmaster.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	softmaster.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	softmaster.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	softmaster.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2012	softmaster.exe
2012	softmaster.exe
2716	rmup.exe
2716	rmup.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2012	softmaster.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2716	rmup.exe
2716	rmup.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2716	2012	softmaster.exe	28
PID 2012 wrote to memory of 2716	2012	softmaster.exe	28
PID 2012 wrote to memory of 2716	2012	softmaster.exe	28
PID 2012 wrote to memory of 2716	2012	softmaster.exe	28
PID 2012 wrote to memory of 2552	2012	softmaster.exe	30
PID 2012 wrote to memory of 2552	2012	softmaster.exe	30
PID 2012 wrote to memory of 2552	2012	softmaster.exe	30
PID 2012 wrote to memory of 2552	2012	softmaster.exe	30

C:\Users\Admin\AppData\Local\Temp\$APPDATA\Microsoft\Internet Explorer\Quick Launch\softmaster.exe
"C:\Users\Admin\AppData\Local\Temp\$APPDATA\Microsoft\Internet Explorer\Quick Launch\softmaster.exe"
1⤵
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\$APPDATA\Microsoft\Internet Explorer\Quick Launch\rmup.exe
  "C:\Users\Admin\AppData\Local\Temp\$APPDATA\Microsoft\Internet Explorer\Quick Launch\rmup.exe" -softmaster -silent
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\$APPDATA\Microsoft\Internet Explorer\Quick Launch\softmaster.exe
  "C:\Users\Admin\AppData\Local\Temp\$APPDATA\Microsoft\Internet Explorer\Quick Launch\softmaster.exe" /postdata /active
  2⤵
  - Writes to the Master Boot Record (MBR)
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.cfg

Path C:\Users\Admin\AppData\Local\Temp\$APPDATA\Microsoft\Internet Explorer\Quick Launch\config\softmaster\config.cfg
Size 432B
SHA256 5dd4be962e1af51702738e0595e834b2891be2faf8b006d6c4bf927f0c7f3a23
MD5 32838d95d5149c0bddad195f36487a7b
SHA1 9b40e12780f08dca90a9320f02f3217f9bc2830b
SHA512 d9c81dbc52985f6ad9c9a06d7fbc28015ae7809f9d820a0cef9515867d47d6243ffeca5efce952a2f8722f1ee06476e00fd481cf78f5b7d74f9b59cfc58acba4
MD5 SHA1 SHA512

Submit Download

memory/2012-63-0x0000000073770000-0x000000007380D000-memory.dmp

Download

memory/2012-58-0x0000000073770000-0x000000007380D000-memory.dmp

Download

memory/2012-107-0x0000000073770000-0x000000007380D000-memory.dmp

Download

memory/2012-106-0x0000000073770000-0x000000007380D000-memory.dmp

Download

memory/2012-72-0x0000000073770000-0x000000007380D000-memory.dmp

Download

memory/2012-71-0x0000000073770000-0x000000007380D000-memory.dmp

Download

memory/2012-57-0x0000000073770000-0x000000007380D000-memory.dmp

Download

memory/2716-27-0x00000000734C0000-0x000000007355D000-memory.dmp

Download

memory/2716-61-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/2716-62-0x00000000047B0000-0x0000000005187000-memory.dmp

Download

memory/2716-5-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/2716-64-0x0000000073770000-0x000000007380D000-memory.dmp

Download

memory/2716-8-0x00000000047B0000-0x0000000005187000-memory.dmp

Download

memory/2716-9-0x00000000047B0000-0x0000000005187000-memory.dmp

Download

memory/2716-26-0x0000000073750000-0x00000000737A8000-memory.dmp

Download

memory/2716-25-0x00000000737B0000-0x0000000073808000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads