457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91

General

Target

457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe
Size

6.0MB
MD5

db2f81022aa778a94399b7d958a6ddc9
SHA1

ee0db450f30e20728550a7e952fc572b88671760
SHA256

457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91
SHA512

ba38f4f8f48b5a20adae1df39246ab3c281dca3f289ce3a06fc9a136c624f04417518fbfa1acc7dd0e885bcb82e1c990d0f828aa0328f6b4009278077d74a5d3
SSDEEP

98304:fbdhDqohDS1F+CRcB27OgUWZHw8VQjr+/bJBAUZLT:fbdhDD23a2sWKjr+TJVH

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe

pid process

3708 457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3708-1-0x0000000000FC0000-0x0000000000FCB000-memory.dmp	upx
behavioral2/memory/3708-2-0x0000000000FC0000-0x0000000000FCB000-memory.dmp	upx
behavioral2/memory/3708-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-35-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-33-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-31-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-7-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3708-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe

description ioc process

File opened for modification \??\PhysicalDrive0 457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe

pid	process
3708	457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe
3708	457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe
3708	457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe

description	pid	process	target process
PID 3708 wrote to memory of 2340	3708	457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe	msedge.exe
PID 3708 wrote to memory of 2340	3708	457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe
"C:\Users\Admin\AppData\Local\Temp\457e98f60801cb9c4d344722ff6eb230bc56e016d96d4d5cd07a9ecdf4c29f91.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://changkongbao.lanzouq.com/ikW9T1cfeg5e
  2⤵
  PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4084,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
1⤵
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4408,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
1⤵
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4644,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
1⤵
PID:1124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=4236,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
1⤵
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5428,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
1⤵
PID:964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5436,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
1⤵
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5916,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
1⤵
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=5920,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
1⤵
PID:2612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=5932,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
1⤵
PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=6360,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
1⤵
PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6524,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230421.lib

Filesize
1.5MB

MD5
ef48d7cc52338513cc0ce843c5e3916b

SHA1
20965d86b7b358edf8b5d819302fa7e0e6159c18

SHA256
835bfef980ad0cedf10d8ade0cf5671d9f56062f2b22d0a0547b07772ceb25a8

SHA512
fd4602bd487eaad5febb5b3e9d8fe75f4190d1e44e538e7ae2d2129087f35b72b254c85d7335a81854aa2bdb4f0f2fa22e02a892ee23ac57b78cdd03a79259b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\·½°¸.ini

Filesize
8KB

MD5
66b747a2e42a147cdd58f6ac27b0559e

SHA1
377d11244426348f252e063c5456fb56ad287dc2

SHA256
9b14dd453bf79634e4b13b51f32a5edd6e079d9e03991a511874b844b3310f3f

SHA512
3d091f68ededb48fbbb2bd1f2c92e192c9e37291cdc4fd272ba3d41d2f257768eb149e61b0ea2d4e849e26dc02f2a5b5b89c021eba1835b634b6d2750b546549

Download Submit
C:\Users\Admin\AppData\Local\Temp\·½°¸.ini

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\¿ì½Ý·¢ÑÔ·½°¸.txt

Filesize
189B

MD5
322f59ce015ff2f1f00ecbe4fdfce380

SHA1
eb4756a5bb023f6d1feacdbeac6e94013e15d5b0

SHA256
c96ef901d8f23cb7626ef980c4cf5bece7aafeef9b2b8b28829d3a11a51562c1

SHA512
2610ce1c0a55da67faa9ddaca26529a87bf5ebc6706621682d54024fa887ca9cd54cdc5b854f8b79ea99b02a5277d6931f633fa876107d9ec1bf503bee23a02c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.ini

Filesize
246B

MD5
b06ddcfdb64cc28ca0a0ef609de5f05f

SHA1
bd95d141935795e249d2ab00824839fd42c8f505

SHA256
da0a5d79dc6a120811b556885b704f9fd158b1f19dd5a9c595719feb56065f00

SHA512
a1dd3cc527ce6a6c4b0ea2c369d4370f6f1bf332c9255e1a8eebfd5986c133dacc2e6c6a55071e5bcf4724f37ff2920f2e17567ca32571e664b458e526be72b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.ini

Filesize
260B

MD5
924bf7a4ce305dad87743ba3c5773aa9

SHA1
12d0fddb472394b23e5176ab4ede38974e723b81

SHA256
01faf5e88442653bf38adc145d517f44d3495398e0aa666c7486b7030c126cbd

SHA512
2380c957717d3bc97ae2de96aba9cd3b50a1774eb96dc47840add1b12ee13485ee6cc6c4d30953b8f42d32ae3b02657966229fcbe58a60843df0cbd6170eb44e

Download Submit
memory/3708-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-35-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-33-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-31-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-0-0x0000000000400000-0x0000000000A6D000-memory.dmp

Filesize
6.4MB

Download
memory/3708-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-7-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-50-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/3708-53-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/3708-52-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/3708-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-98-0x0000000006180000-0x0000000006181000-memory.dmp

Filesize
4KB

Download
memory/3708-97-0x0000000006190000-0x0000000006191000-memory.dmp

Filesize
4KB

Download
memory/3708-47-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/3708-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3708-2-0x0000000000FC0000-0x0000000000FCB000-memory.dmp

Filesize
44KB

Download
memory/3708-1-0x0000000000FC0000-0x0000000000FCB000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads