Overview

overview

8

Static

static

1

300789c9e0...3b.exe

windows7-x64

8

300789c9e0...3b.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2024, 01:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    300789c9e0f6e6ae074879cd502c59d1982096b003d5f6281ee0b25a8bd2013b.exe
  • Size 1.4MB
  • Sample240519-bg71kaad67
  • SHA256 300789c9e0f6e6ae074879cd502c59d1982096b003d5f6281ee0b25a8bd2013b
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\300789c9e0f6e6ae074879cd502c59d1982096b003d5f6281ee0b25a8bd2013b.exe
    "C:\Users\Admin\AppData\Local\Temp\300789c9e0f6e6ae074879cd502c59d1982096b003d5f6281ee0b25a8bd2013b.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\360TS_Setup.exe" /c:WW.ADBcash.CPI202311S25 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Program Files (x86)\1716081032_0\360TS_Setup.exe
        "C:\Program Files (x86)\1716081032_0\360TS_Setup.exe" /c:WW.ADBcash.CPI202311S25 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s /TSinstall
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3204

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        i18n.ini
        • Path C:\Program Files (x86)\360\Total Security\i18n\i18n.ini
        • Size 246B
        • SHA256 f421332fd132d8405cad34871425c9922e4a1b172d74f86b9e4e7ee750205919
        • MD5 SHA1 SHA512
        Submit Download

        [email protected]
        • Path C:\Users\Admin\AppData\Local\Temp\[email protected]
        • Size 656B
        • SHA256 b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e
        • MD5 SHA1 SHA512
        Submit Download

        setup.ini
        • Path C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
        • Size 830B
        • SHA256 9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454
        • MD5 SHA1 SHA512
        Submit Download

        360base.dll
        • Path C:\Users\Admin\AppData\Local\Temp\1716081032_00000000_base\360base.dll
        • Size 1.0MB
        • SHA256 58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\7z.dll
        • Size 1.1MB
        • SHA256 898bf5db34d9997b3d90b87091f34ae4e3e9cf34b6f2ae7fb8fd86e8a1bb684e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SysSweeper.ui.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\config\lang\de\SysSweeper.ui.dat
        • Size 102KB
        • SHA256 794331c530f22c2390dd44d18e449c39bb7246868b07bdf4ff0be65732718b13
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        wd.ini
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\en\safemon\wd.ini
        • Size 8KB
        • SHA256 b0a2dd51d75609b452a16fb26138fb95545212eb6efa274f2751eb74ccc5633f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dsurls.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\es\deepscan\dsurls.dat
        • Size 1KB
        • SHA256 b0355da8317155646eba806991c248185cb830fe5817562c50af71d297f269ee
        • MD5 SHA1 SHA512
        Submit Download

        360ipc.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\es\ipc\360ipc.dat
        • Size 1KB
        • SHA256 0ba4355035fb69665598886cb35359ab4b07260032ba6651a9c1fcea2285726d
        • MD5 SHA1 SHA512
        Submit Download

        360netd.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\es\ipc\360netd.dat
        • Size 43KB
        • SHA256 3b5837689b4339077ed90cfeb937d3765dda9bc8a6371d25c640dfcee296090a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        360netr.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\es\ipc\360netr.dat
        • Size 1KB
        • SHA256 912102c07fcabe6d8a018de20b2ad97ea5f775dcb383cd3376168b7ebf8f9238
        • MD5 SHA1 SHA512
        Submit Download

        filemon.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\es\ipc\filemon.dat
        • Size 15KB
        • SHA256 b065e3e3440e1c83d6a4704acddf33e69b111aad51f6d4194d6abc160eccfdc2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        regmon.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\es\ipc\regmon.dat
        • Size 30KB
        • SHA256 1c743d2e319cd63426f05a3c51dfea4c4f5b923c96f9ecce7fcf8d4d46a8c687
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libdefa.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\es\libdefa.dat
        • Size 319KB
        • SHA256 19fa3cbec353223c9e376b7e06f050cc27b3c12d255fdcb5c36342fa3febbec4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        drvmon.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\es\safemon\drvmon.dat
        • Size 5KB
        • SHA256 5ee31b5ada283f63ac19f79b3c3efc9f9e351182fcabf47ffccdd96060bfa2cf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        art.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\fr\deepscan\art.dat
        • Size 38KB
        • SHA256 81adb709eec2dfb3e7b261e3e279adf33de00e4d9729f217662142f591657374
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dsr.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\fr\deepscan\dsr.dat
        • Size 58KB
        • SHA256 4649eedc3bafd98c562d4d1710f44de19e8e93e3638bc1566e1da63d90cb04ad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dsconz.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\hi\deepscan\dsconz.dat
        • Size 18KB
        • SHA256 bbabbf0df0d9b09cf348c83f8926fef859474e5c728936e75c88cd0ac15d9060
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bp.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\it\safemon\bp.dat
        • Size 2KB
        • SHA256 d81e7765dacef70a07c2d77e3ab1c953abd4c8b0c74f53df04c3ee4adf192106
        • MD5 SHA1 SHA512
        Submit Download

        DsRes64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\deepscan\DsRes64.dll
        • Size 66KB
        • SHA256 41fc1d658e3d6795b701495d45e8d7bef7d8ce770138044b34fbacad08a617be
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NetDefender.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\ipc\NetDefender.dll.locale
        • Size 24KB
        • SHA256 4d1a978e09c6dafdcf8d1d315191a9fb8c0d2695e75c7b8650817d027008d1c1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Sxin.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\ipc\Sxin.dll.locale
        • Size 48KB
        • SHA256 7e885136a20c3ab48cdead810381dccb10761336a62908ce78fe7f7d397cde0e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Sxin64.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\ipc\Sxin64.dll.locale
        • Size 46KB
        • SHA256 ee05002e64e561777ea43ac5b9857141dabb7c9eed007a0d57c30924f61af91e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        appd.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\ipc\appd.dll.locale
        • Size 25KB
        • SHA256 86506ad8b30fc115f19ea241299f000bce38626fe1332601c042ee6109031e89
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        filemgr.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\ipc\filemgr.dll.locale
        • Size 21KB
        • SHA256 463916c13812228c4fb990a765cbb5d0ee8bb7a1e27de9bdcea1a63cc5095a6a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        yhregd.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\ipc\yhregd.dll.locale
        • Size 18KB
        • SHA256 02e934cbf941d874ba0343587a1e674f21fd2edef8b4a0cc0354c068ec6fe58b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        360SPTool.exe.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\safemon\360SPTool.exe.locale
        • Size 31KB
        • SHA256 15164d3600abd6b8f36ac9f686e965cfb2868025a01cded4f7707b1ae5008964
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        360procmon.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\safemon\360procmon.dll.locale
        • Size 106KB
        • SHA256 51475f2fa4cf26dfc0b6b27a42b324a109f95f33156618172544db97cbf4dddd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Safemon64.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\safemon\Safemon64.dll.locale
        • Size 52KB
        • SHA256 129a7ba4915d44a475ed953d62627726b9aa4048ffcc316c47f7f533b68af58b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SelfProtectAPI2.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.locale
        • Size 21KB
        • SHA256 a71e57cafb118f29740cd80527b094813798e880de682eca33bfe97aaa20b509
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        safemon.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\safemon\safemon.dll.locale
        • Size 53KB
        • SHA256 110914328d4bf85058efa99db13bfec2c73e3b175b91dfd6b41c6fa72ebaa103
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spsafe.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\safemon\spsafe.dll.locale
        • Size 9KB
        • SHA256 61c130d1436efba0a4975bc3f1c5f9fdf094a097d8182119193b44150344940e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spsafe64.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\safemon\spsafe64.dll.locale
        • Size 9KB
        • SHA256 9327e539134100aa8f61947da7415750f131c4e03bbb7edb61b0fab53ea34075
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nptswp.dll.locale
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.locale
        • Size 10KB
        • SHA256 09d58a2f0656a777a66288ac4068aa94a2d58d0534328862b8371709eab2003b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        appmon.dat
        • Path C:\Users\Admin\AppData\Local\Temp\360_install_20240519011034_240759546\temp_files\i18n\pt\ipc\appmon.dat
        • Size 28KB
        • SHA256 f635978ce8fc3a30589f20fd9129737585cc29e59d5170ec0d50f1be6aca14c4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        360P2SP.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{54172E99-5599-45b9-AF90-DD42997EBCF2}.tmp\360P2SP.dll
        • Size 824KB
        • SHA256 bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/228-9-0x00000000040F0000-0x00000000040F1000-memory.dmp
        Download