900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe
Size

7.1MB
MD5

b4bb979fb3f26bbc396e0c5c55d0df01
SHA1

f69b6395cbba9b75b91125d7ed1b1d1f9364211f
SHA256

900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937
SHA512

5f90816aaf8e0a7a91aee2158e9cb5e5805eb302c5f2c7285a2342fd59a5a8ac3d64ef8cb18510257761aa26894ade9d8ce1bdb07e0d9aa1602255fea9a841cb
SSDEEP

196608:xiAgT8Hz65Mm1U1W4qgsQzDdxsWdDeDAApd5:vgIqOA5LatDAl/5

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe

pid process

2436 900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2436-0-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-9-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-10-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-11-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-12-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-13-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-14-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-15-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-16-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-17-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-18-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-62-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-66-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-70-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-68-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-28-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-26-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-24-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-73-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-74-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx
behavioral2/memory/2436-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2436-77-0x0000000000400000-0x0000000000D0E000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe

description ioc process

File opened for modification \??\PhysicalDrive0 900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe

pid	process
2436	900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe
2436	900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe
2436	900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe
2436	900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe

description	pid	process	target process
PID 2436 wrote to memory of 3668	2436	900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe	nslookup.exe
PID 2436 wrote to memory of 3668	2436	900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe	nslookup.exe
PID 2436 wrote to memory of 3668	2436	900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe	nslookup.exe
PID 2436 wrote to memory of 3528	2436	900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe	nslookup.exe
PID 2436 wrote to memory of 3528	2436	900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe	nslookup.exe
PID 2436 wrote to memory of 3528	2436	900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe
"C:\Users\Admin\AppData\Local\Temp\900a8acc750dbdc1e8b99e51d76a963fad47564c15da5dae9a08c329b9bba937.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\SysWOW64\nslookup.exe
nslookup -qt=TXT ns2.60r.cn
2⤵
PID:3668

C:\Windows\SysWOW64\nslookup.exe
nslookup -qt=TXT ns1.60r.cn
2⤵
PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E2EECore.3.3.4.dll

Filesize
10.6MB

MD5
fb1c3c33a5da0ff787dedf3ae18a274f

SHA1
b05b9504460ec32fdf2301d4734b4f064f6146b8

SHA256
478584be80f2587b739d177294402a5bc97464f98fff79d065e506bf521ec337

SHA512
2d29eb7ce018834462e2d478783a9a67e9fa6d5a1c1a17d92758e06ac8eaee7fd22d9eebde308e97d967ef43a39b15025f871c41a37c819136313ff190b1998b

Download Submit
memory/2436-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-11-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-10-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-0-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-12-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-13-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-14-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-15-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-16-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-17-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-62-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-66-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-70-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-68-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-64-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-18-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-9-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-28-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-26-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-24-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-73-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-74-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download
memory/2436-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2436-77-0x0000000000400000-0x0000000000D0E000-memory.dmp

Filesize
9.1MB

Download