1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a

General

Target

1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe
Size

10.3MB
MD5

d2e8cfb12ce010eecd8ac33dae650027
SHA1

3b988d0bca1bf4dde9d3cce7ed9e03015a932e0e
SHA256

1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a
SHA512

d7764753a51b825ff66a89a7e18342d811fff40c7d0ca18b217f6dfc6b3e7a0c9446e7dd8266d4ce64eeb17acac66d8aaa9fedebf4018fc857bd66ca2d2f3fb8
SSDEEP

196608:ScvijmrWdYtMEY1nxKU5ltd1VNTdfgxBD29qfHJhIdg6DnoVOX:ScvkuSDnzHd7SjCephIr

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe²Ôñ·µÀ¶Ü.exe1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe²Ôñ·µÀ¶Ü.exe

pid	process
2712	1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe
564	²Ôñ·µÀ¶Ü.exe
596	1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe
2152	²Ôñ·µÀ¶Ü.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2456-41-0x0000000000360000-0x0000000000368000-memory.dmp	upx
behavioral1/memory/2456-40-0x0000000000350000-0x000000000035B000-memory.dmp	upx
behavioral1/memory/2456-39-0x0000000000340000-0x000000000034B000-memory.dmp	upx
F:\²Ôñ·µÀ¶Ü(Î¢¶Ë)\²Ôñ·µÀ¶Ü.exe	upx

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe

description	ioc	process
File opened (read-only)	\??\F:	1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe
File opened (read-only)	\??\F:	1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe
File opened for modification	\??\PhysicalDrive0	1a2dcf169e541ba2d4ef4bed07e7c69e7c58b35cd28d07afad4cebfd115b145a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

²Ôñ·µÀ¶Ü.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	²Ôñ·µÀ¶Ü.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	²Ôñ·µÀ¶Ü.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

²Ôñ·µÀ¶Ü.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	²Ôñ·µÀ¶Ü.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	²Ôñ·µÀ¶Ü.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	²Ôñ·µÀ¶Ü.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	²Ôñ·µÀ¶Ü.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes: