36f6c9ab1126f0d30af8acc783d58273398fe26dab32372c8fcc13063b31861f

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INLAB CLIENTE.exe
Size

3.5MB
MD5

080c2c3d5cc7ab1029f12d08b403cc50
SHA1

6f0dd3f538a654950c8dfdf9e2a0b0b784a999f0
SHA256

84ff9bc30a5062515928c38b3bee7b0b3976c3089e25e3784bd4e78256f36cf1
SHA512

ef08eba8ee065777cc77a9191ee0658e015cecceb0fa7fe26555fa600660d9c0e4a7af746ad870faccc6953cfc39f2af713ddc9a5e102e2fb66669bc3cf0602e
SSDEEP

98304:ZUSkVbU8a86PGZ/ITGVKdigkgxFquID206I3zv4IF5:OSwa86OVIT2qirg0J3zwg

Score

7^/10

bootkit persistence vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/228-8-0x0000000000110000-0x0000000000941000-memory.dmp	vmprotect
behavioral2/memory/228-11-0x0000000000110000-0x0000000000941000-memory.dmp	vmprotect
behavioral2/memory/228-12-0x0000000000110000-0x0000000000941000-memory.dmp	vmprotect
behavioral2/memory/228-13-0x0000000000110000-0x0000000000941000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	INLAB CLIENTE.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
228	INLAB CLIENTE.exe
228	INLAB CLIENTE.exe
228	INLAB CLIENTE.exe
228	INLAB CLIENTE.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
228	INLAB CLIENTE.exe
228	INLAB CLIENTE.exe

C:\Users\Admin\AppData\Local\Temp\INLAB CLIENTE.exe
"C:\Users\Admin\AppData\Local\Temp\INLAB CLIENTE.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4020,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/228-0-0x00000000002A7000-0x00000000005CB000-memory.dmp

Filesize
3.1MB

Download
memory/228-1-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/228-8-0x0000000000110000-0x0000000000941000-memory.dmp

Filesize
8.2MB

Download
memory/228-7-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/228-6-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/228-5-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/228-11-0x0000000000110000-0x0000000000941000-memory.dmp

Filesize
8.2MB

Download
memory/228-4-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download
memory/228-3-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/228-2-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/228-12-0x0000000000110000-0x0000000000941000-memory.dmp

Filesize
8.2MB

Download
memory/228-13-0x0000000000110000-0x0000000000941000-memory.dmp

Filesize
8.2MB

Download