01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be

Analysis

max time kernel
135s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe
Size

3.1MB
MD5

4599d094c84c6c0e9d2f4e80c2a12991
SHA1

d426035f16b9e50028b61b0aedc3d89219956561
SHA256

01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be
SHA512

412cc95834364d9c24a6e93232361419bb2d8c9708301e3f3857339cb4d88b022137e04c155ec5a26924c471bd25762fc60563ce9705b974e15b0797b8c42890
SSDEEP

49152:KMKgb9TR6PeMRFr5KdDeB4scfWRRpilPEpNW9Nsazgiw9mAGenGijWg6OMcAbdJO:XKcQRF9EkcfWRRclPEzPFiwr3GsCJO

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe

Executes dropped EXE 1 IoCs

Processes:

SDExtClient.exe

pid process

4920 SDExtClient.exe

pid	process
4920	SDExtClient.exe

Loads dropped DLL 8 IoCs

Processes:

01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exeSDExtClient.exe

pid	process
4564	01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe
4920	SDExtClient.exe
4920	SDExtClient.exe
4920	SDExtClient.exe
4920	SDExtClient.exe
4920	SDExtClient.exe
4920	SDExtClient.exe
4920	SDExtClient.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe

description ioc process

File opened for modification \??\PhysicalDrive0 01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

SDExtClient.exe

pid process

4920 SDExtClient.exe
4920 SDExtClient.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe

pid	process
656

pid	process
4920	SDExtClient.exe
4920	SDExtClient.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe

description	pid	process	target process
PID 4564 wrote to memory of 4920	4564	01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe	SDExtClient.exe
PID 4564 wrote to memory of 4920	4564	01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe	SDExtClient.exe
PID 4564 wrote to memory of 4920	4564	01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe	SDExtClient.exe

C:\Users\Admin\AppData\Local\Temp\01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe
"C:\Users\Admin\AppData\Local\Temp\01fcf64981490769874eafa073ce104c487c01d407c5101d1ec4739e7d1236be.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\SD_47E8\SDExtClient.exe
  "C:\Users\Admin\AppData\Local\Temp\SD_47E8\SDExtClient.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SD_47E8\DecresePrint.exe

Filesize
314KB

MD5
b3603b9b5388f6ac61b54bf478b5c969

SHA1
9746d6e5749ae45a0d50bb65bfb8b64645da55e3

SHA256
428b983c0b0b12f8fb8422408b0e7094f01b7ce11b807d353bbd17bb68133f30

SHA512
bb5f14ec32e3a5b8c3d168c966f2a6f2bb5b66c50330cf4667316c38b4f2e856425dd48770a6c5e398cfe6b8d066db931fa4e6be120e988ed65273b0e1a06ced

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\ExePath.ini

Filesize
116B

MD5
d24942ae2b76717709a27d22962fa5e9

SHA1
07388c4237137a73de4abd009ade54b68a884b95

SHA256
cd47e6028dc069d0f666860c66edcae5b264931edbcb4f1641a29f87805a1a05

SHA512
4725fb62a3f2929284689f8e78ddad70f68ed46134e9133587d13ed11119ef90910841de43e9ea1850d7124dabca23c769240c6951817d871f3276c81ffdf872

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\FSPFileOut.dll

Filesize
50KB

MD5
0310cfe97fafd9392c8926241a54002a

SHA1
35adc58c9c6c897a6f5d4c3b805324d970ff98dc

SHA256
e9c27d7e6585626bff5f021a88ae295e78bbbbef573ba6787dd241457acf9c6c

SHA512
ba37f45676fea851e2af585c884f942d030d2e97fee63b05bfc3820b7612fd7c10f77b2018a11ab6eb985160c04104a842a7021ed43115e46d79194e4321537b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\FSPFileOut.sys

Filesize
21KB

MD5
c7046e9d79dad56500c7f01ea9b50317

SHA1
dcac96f3327f0a6f42de883dfab4ae6f4c4ed4f6

SHA256
c99863b250e9308ff2ba47e88dd5caad9c2e119e9a17ace88bb2a7bc7153c43c

SHA512
26656cf83951da906fef954cb85919560888d5a4dc6fedff1a9876c654f2167a2851f85c203fb1da0bdab8d70d1e25194d26cb57031771d921ae606a480e3222

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\FSPFileOut64.sys

Filesize
24KB

MD5
281fa560240cded410a958faab4f3a81

SHA1
73eefc8baa4cb8625fd177356607ca0a7539cbc5

SHA256
4f795529d7b886b694e437c4793fbb20c2b039e8a8cd881f12b53755743e9f23

SHA512
7ec626936e20f509e97defb61caeb5ff1f42e2c2a299c15af15f47107a078025d63fdd7310feba036ca1918dd0ae8359887dc8a0c83d5a25049a4b44fe95f410

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\FSP_PrintLimit.dll

Filesize
218KB

MD5
d5b3279eb9b8058bcdd88a82d522979e

SHA1
e90d0290ed8eed045db3b9c7cd1235bd2531e168

SHA256
6f858a704d9840781e50e8b2af73e48a881fed3b67b88563026da90497f05e33

SHA512
d79f046319558d162a4fcab70737d7045ea0bececa88a19d074271144619f9237cbd0dc41b19e09c853fdab03817f20314c5330082a44d0cb8a09ef22a464a96

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\FSP_PrintLimit64.dll

Filesize
253KB

MD5
8c0fe4eb0c0566dc6b578abf504c8e4f

SHA1
f41f6e69101cb9e84835488dc3c4069db263d631

SHA256
299f0fa7f59a7f3ca7ecbe08db3a9570d3d1cec95d4b787275ccd75c029ca2ab

SHA512
5d7ad2b666a666e9b7f5ce6c95dab1f811a957d0917597f353c00a830b65f2f1b0924eee170f06514b34e843b0b3b98f9857329fcdd4c7abf58298ef0b4708cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\FileRedirectEx.dll

Filesize
89KB

MD5
5b0f4c573d35c3818e74305c93e3be29

SHA1
e3b8cac63edae3ada8e5e32eb64ac37c52c195b2

SHA256
49f9135dddd740f8c21e30f81fbc8be7ca05df08304c4ef62b40da21f99a8bd7

SHA512
8a67d5353ce1bc7666d1cb33034c6d28d4fd2efb01855af74d3cc1057bdb9b5e68496b35276012fa5616b49d38962b7a7f17a93d60e0ff4ee63f63d4597549ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\Fsp_Notice.dll

Filesize
531KB

MD5
16ddd1e7aec3b76b06ad46c34c869ef5

SHA1
c65d196c9d310f9e3733d7d726a5cbbefd4404d0

SHA256
3e7a3c2d7483fbbb93eae2c87feb5dd7e25f73edd31612aaa7966ad364a6be4d

SHA512
d06d7a975535b7ec8062fd8a9a5e6524c01f31fe4161ada02182f21e3a6c6711f3e4ea23d5930758527ef3db4f23f1d6170f2bd664542887db14b336a3acbc34

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\ImpControl.dll

Filesize
37KB

MD5
e88bfbe7e63480f1e69769384e918578

SHA1
96ccd80e5d28acbb528da416ec7f30b4138306f9

SHA256
226d470e7cfcd5e319a3c1a610f3c7e9b6d26377af902c9b73fc6f30097be634

SHA512
90fc5327774c1e382793deb53fdf9ae58aa66186c4ed68723a38b0e4399c3d733ddb8aafcbbbc946e9a86ea82c6285201e2861300537cb4044de4b9cd31ffc06

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\LoaderInterface.dll

Filesize
60KB

MD5
f5f001ca8cdac172286ffaeaf1ab4e13

SHA1
e89b2b326084a286ea57aa76ed0138baf9d6c9a6

SHA256
cd85db8ae064cc14c38892ca632073a7d9d1880abc08c5854bfb3d89f83f7eef

SHA512
f98446e039e6f788dc2bc8b24cecb40c53fded01d6a08aec12f18977df0fde566cafaeec3db26c1b5c4d23de28194656985e958b14c1b02bb91c969f104e7a59

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\SDCommon.dll

Filesize
71KB

MD5
e21b7c64b236181645ea7e3d26e7a928

SHA1
c73c82ce09f10e3604c0c12fe5e13f0a51c921b5

SHA256
37d14827cf93ba1cad060c8c5c0d2576d96d9230efb1201b7cc19f98d6020b0c

SHA512
55e2440c968593e6bcc5586c81bff9a2a6516b0a99ddec3ef2e07afc03a384ec5a00dd1d48106f881ebeb1a1a418cb3d255ba665ddc27d80026a66c936e0a94f

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\SDCommonEx.dll

Filesize
199KB

MD5
534ebb974cabdb64b5503b4727877024

SHA1
bc571ac14dadbf43770d68facca2b0953cd9ed05

SHA256
748aa576deffe0b93a5e446d01e53cddf52d38bf6a6ea6252d636326e7a4340b

SHA512
51a6a2d0b2b283faeffeaf3879d84ab37b72916b951eb41f9439a2486fef135c0c91f539541d158e63e2393a1ba5370075bf8e586ee38d82e9a4b1d7b2ec0207

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\SDExtClient.exe

Filesize
2.9MB

MD5
c2b721bf5ba2e41588304d553bfa3466

SHA1
b6a09708706112871d795a2b4d8ba8f85f667fab

SHA256
bdaff354d371b36595e2007fdbb8e2bce270a581a2bb2fec9d5b7bd02491e103

SHA512
b37344c1a24eee2c1e5971e26a735bc430db62783485f494b9d7147ac9855d36613a4c511f4d26d5d5c03fe0b8ddc8156f66892b982298b3b7b722f4d558d3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\SDExtPolicy.lst

Filesize
3KB

MD5
47f9b46afef1edc94a4f331102b0d13c

SHA1
0173b0f185da213ee9647253dffecc6f4ff5cbf2

SHA256
de685990345c5b2a3840541676f62d21247cf9e0c1958d06d1b3b7aa6d1c4c85

SHA512
5c45bf1fde1e1bbcf6b4a7404658b18a29983c358ff97288035d6cc440d974bfc2e5ab6344d430812521cf4d9852394bb615c490dacc78df3a5a756fc2c42c18

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\SDOutHook.dll

Filesize
280KB

MD5
1597f8b1850b7825ade925131c3b297a

SHA1
a06ed3b96436435c19f953f2aadc325d8d98bf19

SHA256
569dd83805efd18da118e14b81bd384fab5a5d257383302510f65787bfdc8f62

SHA512
a58a8f7205b4275d81e02bbd8dd84ded198c38a84c9e32352178220f7b7bcdc7d5326d64460089dc53b16d3e2bb1a918bf80755f4a7a4b0a467ac4aafe0f1730

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\SDOutHook64.dll

Filesize
311KB

MD5
ee5d0fc12329b6b6b2d8b0edb6c56078

SHA1
a321cb9068180a419e535c1c6df25937d9514ffe

SHA256
cc3d3baa9e5c6cd2d47ab8bfa96ebb79d48ee9386a202d2c672f81358cccc201

SHA512
9d180aa04086279aeb83f0728f53b9ea65639220d0f365bab6c16e8f2706333f69fcf964db564cbe8b68569ad300a9f75966d32d10020a2241b898aeed6d38f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\SDOutHookLoader.exe

Filesize
85KB

MD5
74fb536b7d928ab6baf698fb44922a9f

SHA1
a597e9d4f1d66097e7e20dbe46207d255e6722af

SHA256
1fab3a8b8e043aa91c17316927396e647d757c7705a3ad724c68de5546793876

SHA512
6ced3265556731748640332e7192bd18cfd5a78f363afc41bb30e283372173adef041c5dd4243c221f95eadf51864c1a63d9975394f2abedb46f470aa78f9bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\SDOutHookLoader64.exe

Filesize
94KB

MD5
9a9678b6a44ad0187bdf44482261cbfb

SHA1
b349453262d332703c9036965f10fad9b49b2ce3

SHA256
8e6a8424173c14a7b897f1af8385578c9c8ce1887c708a9999b37b82b1ae4ce7

SHA512
8c7fd316d5361f4e5c0dadeea9b5f9d2aa554c319d8438852a20f59073d38386d92132dfada3365311fc13f31cd4f9f62ef1ce3436bb43e1e8194d854a5dee6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\SD_AssistP.dll

Filesize
76KB

MD5
b3f3758a563104345e37498579f91e39

SHA1
e4130c49b342dd6aa8bba85ba89d6d519ed1a194

SHA256
05bd3f7342b60405a37da0ad0f7f68a6a7cc9ab5482747fad08e8fdfb2f7a9b9

SHA512
67e104d1e99b31b601c69354e4b2f562e01e7ac37305043c93f85b852a9befd6ccd2aef9736f2c1509ef823ccd78361cff0612236ea7a27a4daf9ead9e731ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\SelfExtract.exe

Filesize
1004KB

MD5
8bdcb2c5a3eb175394deb0d90bcc8263

SHA1
e6f8aa5332a989e69c246ba78f6783c58ac4cfa4

SHA256
859b923457c7c084008e2fcf75e6dd309f24d1b3f93514c08e73d9469fccddd6

SHA512
94310458b6b165192b61dfd1cbdb9e87e05e2d704464b143a39773f9838a5db967954a7c0d2c03a0e258ecd62932875533b811bea5d1d99e57a2cc0d8e40832b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\csp_crypto_dll.dll

Filesize
76KB

MD5
c644949671ca7e0c5055207a0a4c45ab

SHA1
523705caa026c77b082c25d6c5b64d0e3fd6d2ee

SHA256
30d763349c73cd39411406fa2f4aab5edda2394b9d8e200a7df86d1e39cecc0f

SHA512
7260574b09a059e45c06f62c9166858a42d37d1ca54a2f7cda2de2d6dafad44923bbf7649cb213e026ea3f6f74479514c0badb6f954e1e534c1dfd465608ccd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\SD_47E8\csp_soft.dll

Filesize
136KB

MD5
a7c97559d7137d256c4df9725fbd30db

SHA1
b66a0d1308d532bfa5b766a9aa7922c1d71a436f

SHA256
fdac77981aa42256b881f29365079801385fce16d5a095e8321611cb22480eb5

SHA512
fdf7c804b139b88e80defd2fd6dd015acadecad267c9330ba23bdf0b47197cc6a1a185b4cc14eee6c45a942630036db736081e1db578dc6dcb454454811dc762

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb47C8.tmp

Filesize
1KB

MD5
607f71634812be52285b38bf5e1045da

SHA1
fc6c1be4daf417a58528441f9d8f4e3deef5a729

SHA256
8473b73da507b05ce3bf000c831f9e4227a8efbae8df2ff774bebd4932ab2bb5

SHA512
dde318c9852827cc65079a2921d2bf47691d670421946426e59f98066f018266119b728da5bb77d311274e689004e99786e3edf1edb315178652eda161bc4b5f

Download Submit
memory/4564-6-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download
memory/4564-2-0x00000000770C2000-0x00000000770C3000-memory.dmp

Filesize
4KB

Download
memory/4564-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-8-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download
memory/4564-3-0x00000000770C3000-0x00000000770C4000-memory.dmp

Filesize
4KB

Download
memory/4564-76-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download
memory/4564-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download