2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483

General

Target

2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
Size

7.7MB
MD5

9677a6cf8c17c91ff9c15eac1dc0cdf0
SHA1

d6e1073d528f7d2a86cae207e7e312fff40e149e
SHA256

2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483
SHA512

0400c3b378f596f06d23cb5f41d79f1ac964cccf320a6bc27dff2f41e6bb9ec93edbadd41c8ff20b4706763ae2e535d11923937e2ffb0cfaf38f963c39402207
SSDEEP

196608:UE2ZfPD19pSC6Kgrdl8322Jp3h0FPvQsgSOTFVt8:UR9pSC6KSIm273h0Kzl

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/548-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-35-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-33-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-31-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-7-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-6-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/548-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 8 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/548-0-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral2/memory/548-2-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral2/memory/548-48-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral2/memory/548-49-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral2/memory/548-54-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral2/memory/548-55-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral2/memory/548-56-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect
behavioral2/memory/548-57-0x0000000000400000-0x0000000001578000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe = "11000"	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
548	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
548	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
548	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
548	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
548	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
548	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
548	2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe

C:\Users\Admin\AppData\Local\Temp\2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe
"C:\Users\Admin\AppData\Local\Temp\2b33b8d4bdfda4df3c2faac821b84930cd660b48f6f1779ca688e2041a275483.exe"
1⤵
- Drops file in Drivers directory
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-0-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/548-1-0x0000000000401000-0x0000000000697000-memory.dmp

Filesize
2.6MB

Download
memory/548-2-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/548-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-48-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/548-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-49-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/548-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-35-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-33-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-31-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-7-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-6-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/548-54-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/548-55-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/548-56-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download
memory/548-57-0x0000000000400000-0x0000000001578000-memory.dmp

Filesize
17.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads