e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a

General

Target

e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.exe
Size

405KB
MD5

9b9127a962a1348c4ccc6a119e893a9d
SHA1

af39c850e9a28d1a9ea6107ec4f4d0b969e1f9d0
SHA256

e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a
SHA512

d3dc5901b15cc44eafb73d0d0b96397271cba3d16e12a113634d0590c774fc740a9400917b2ff6d6a9620009a65b0345b2f16f38b74b8033a05f658e5ba62881
SSDEEP

6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4+:gtRfJcNYFNm8UhlZGse+

Score

8^/10

bootkit persistence spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
3	2552	rundll32.exe
7	2552	rundll32.exe
8	2552	rundll32.exe
9	2552	rundll32.exe
10	2552	rundll32.exe
13	2552	rundll32.exe
14	2552	rundll32.exe
15	2552	rundll32.exe
17	2552	rundll32.exe
18	2552	rundll32.exe

Deletes itself 1 IoCs

Processes:

msqyz.exe

pid process

2036 msqyz.exe
Executes dropped EXE 1 IoCs

Processes:

msqyz.exe

pid process

2036 msqyz.exe
Loads dropped DLL 6 IoCs

Processes:

cmd.exerundll32.exe

pid process

1256 cmd.exe
1256 cmd.exe
2552 rundll32.exe
2552 rundll32.exe
2552 rundll32.exe
2552 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2036	msqyz.exe

pid	process
2036	msqyz.exe

pid	process
1256	cmd.exe
1256	cmd.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\sfvcsjmki\\nmtog.dll\",Verify"	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
File opened (read-only)	\??\b:	rundll32.exe
File opened (read-only)	\??\k:	rundll32.exe
File opened (read-only)	\??\l:	rundll32.exe
File opened (read-only)	\??\u:	rundll32.exe
File opened (read-only)	\??\a:	rundll32.exe
File opened (read-only)	\??\p:	rundll32.exe
File opened (read-only)	\??\q:	rundll32.exe
File opened (read-only)	\??\s:	rundll32.exe
File opened (read-only)	\??\v:	rundll32.exe
File opened (read-only)	\??\n:	rundll32.exe
File opened (read-only)	\??\i:	rundll32.exe
File opened (read-only)	\??\m:	rundll32.exe
File opened (read-only)	\??\w:	rundll32.exe
File opened (read-only)	\??\z:	rundll32.exe
File opened (read-only)	\??\h:	rundll32.exe
File opened (read-only)	\??\g:	rundll32.exe
File opened (read-only)	\??\j:	rundll32.exe
File opened (read-only)	\??\o:	rundll32.exe
File opened (read-only)	\??\r:	rundll32.exe
File opened (read-only)	\??\t:	rundll32.exe
File opened (read-only)	\??\x:	rundll32.exe
File opened (read-only)	\??\y:	rundll32.exe
File opened (read-only)	\??\e:	rundll32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 rundll32.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

2552 rundll32.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	rundll32.exe

Drops file in Program Files directory 2 IoCs

Processes:

msqyz.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\sfvcsjmki	msqyz.exe
File created	\??\c:\Program Files\sfvcsjmki\nmtog.dll	msqyz.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1700 PING.EXE

pid	process
1700	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 2552 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.exemsqyz.exe

pid process

552 e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.exe
2036 msqyz.exe

description	pid	process
Token: SeDebugPrivilege	2552	rundll32.exe

pid	process
552	e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.exe
2036	msqyz.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.execmd.exemsqyz.exe

description	pid	process	target process
PID 552 wrote to memory of 1256	552	e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.exe	cmd.exe
PID 552 wrote to memory of 1256	552	e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.exe	cmd.exe
PID 552 wrote to memory of 1256	552	e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.exe	cmd.exe
PID 552 wrote to memory of 1256	552	e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.exe	cmd.exe
PID 1256 wrote to memory of 1700	1256	cmd.exe	PING.EXE
PID 1256 wrote to memory of 1700	1256	cmd.exe	PING.EXE
PID 1256 wrote to memory of 1700	1256	cmd.exe	PING.EXE
PID 1256 wrote to memory of 1700	1256	cmd.exe	PING.EXE
PID 1256 wrote to memory of 2036	1256	cmd.exe	msqyz.exe
PID 1256 wrote to memory of 2036	1256	cmd.exe	msqyz.exe
PID 1256 wrote to memory of 2036	1256	cmd.exe	msqyz.exe
PID 1256 wrote to memory of 2036	1256	cmd.exe	msqyz.exe
PID 2036 wrote to memory of 2552	2036	msqyz.exe	rundll32.exe
PID 2036 wrote to memory of 2552	2036	msqyz.exe	rundll32.exe
PID 2036 wrote to memory of 2552	2036	msqyz.exe	rundll32.exe
PID 2036 wrote to memory of 2552	2036	msqyz.exe	rundll32.exe
PID 2036 wrote to memory of 2552	2036	msqyz.exe	rundll32.exe
PID 2036 wrote to memory of 2552	2036	msqyz.exe	rundll32.exe
PID 2036 wrote to memory of 2552	2036	msqyz.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.exe
"C:\Users\Admin\AppData\Local\Temp\e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\msqyz.exe "C:\Users\Admin\AppData\Local\Temp\e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1700
- - C:\Users\Admin\AppData\Local\Temp\msqyz.exe
    C:\Users\Admin\AppData\Local\Temp\\msqyz.exe "C:\Users\Admin\AppData\Local\Temp\e264d04ff1ffa9d994b11f15154295c5820fd26a954b3b30f99c5c603cb5045a.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - \??\c:\windows\SysWOW64\rundll32.exe
      c:\windows\system32\rundll32.exe "c:\Program Files\sfvcsjmki\nmtog.dll",Verify C:\Users\Admin\AppData\Local\Temp\msqyz.exe
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Adds Run key to start application
      Enumerates connected drives
      Writes to the Master Boot Record (MBR)
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\Program Files\sfvcsjmki\nmtog.dll

Filesize
228KB

MD5
9e7143c1efd733b56f67224c1314cad5

SHA1
a788f6629591c108f6c63f38617bbf87649e880a

SHA256
f116390a8a89220fa6123e41c509745eedf02d024ed886d560859f991f2ed970

SHA512
fd2e9a59d76402adb8335e7ecbeb80a27c03011ed0137c2c7e1a233f54f0d064bffaba77fddaea137b8467a9e8b7e42c14b48b0783df97dd735812c8befdc8c1

Download Submit
\Users\Admin\AppData\Local\Temp\msqyz.exe

Filesize
405KB

MD5
cba724a95c2c967f653ca77e073e411e

SHA1
ecb4a453add810d8b7199b42e53dcc7d4eef8d92

SHA256
aacf27aad7ab77c4133bc5daf25234f2898eacd7bbb4a30e1913ce3030ffb9f4

SHA512
8a9005d5bd98e1d7fad464e45708e9639f17a9f1c5340e97053896c01b83bd4cb50d0369ade82e7cafe620d3d7b7a1de377423283ff45b9110eb371ec663c7a1

Download Submit
memory/552-2-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/552-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1256-7-0x00000000022D0000-0x0000000002334000-memory.dmp

Filesize
400KB

Download
memory/1256-6-0x00000000022D0000-0x0000000002334000-memory.dmp

Filesize
400KB

Download
memory/2036-10-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2552-16-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/2552-19-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/2552-18-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/2552-17-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/2552-20-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/2552-22-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads