2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483

General

Target

2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
Size

7.7MB
MD5

9677a6cf8c17c91ff9c15eac1dc0cdf0
SHA1

d6e1073d528f7d2a86cae207e7e312fff40e149e
SHA256

2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483
SHA512

0400c3b378f596f06d23cb5f41d79f1ac964cccf320a6bc27dff2f41e6bb9ec93edbadd41c8ff20b4706763ae2e535d11923937e2ffb0cfaf38f963c39402207
SSDEEP

196608:UE2ZfPD19pSC6Kgrdl8322Jp3h0FPvQsgSOTFVt8:UR9pSC6KSIm273h0Kzl

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2200-14-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-31-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-33-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-35-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2200-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 8 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral1/memory/2200-11-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral1/memory/2200-43-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral1/memory/2200-57-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral1/memory/2200-62-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral1/memory/2200-63-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral1/memory/2200-64-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral1/memory/2200-65-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe = "11000"	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2200	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
2200	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2200	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
2200	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
2200	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe

C:\Users\Admin\AppData\Local\Temp\2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
"C:\Users\Admin\AppData\Local\Temp\2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe"
1⤵
- Drops file in Drivers directory
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-0-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/2200-7-0x0000000076740000-0x0000000076741000-memory.dmp

Filesize
4KB

Download
memory/2200-3-0x0000000077C20000-0x0000000077C21000-memory.dmp

Filesize
4KB

Download
memory/2200-1-0x0000000077C20000-0x0000000077C21000-memory.dmp

Filesize
4KB

Download
memory/2200-11-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/2200-14-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-31-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-33-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-43-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/2200-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-35-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2200-57-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/2200-62-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/2200-63-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/2200-64-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/2200-65-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads