aafa6a4f711b3db0eec7c854908102fef395d50188a8a8c36efc188b3d8a5329

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zmxy3hmnxgq/data/program2.exe
Size 827KB
Sample240613-dc4tfssamb
SHA256 71f46644a7e33b7e0eec8cbe994e0b3969fee1da331ee72a30880782affc65b8
MD5 aa86c3838043d730ef8cd5a61605dcb8
SHA1 68952ca94afac9e19356d5666f062e7c1b4c8866
SHA512 e64dcf1fc1c2b470cf0d4580ad4cf2e205f25780886ae7dad5baa5931c91b3bbdff05608045527bf929e0dde06c80e0fd719b7e52ea5e9eb17347902e7b6c60a
SSDEEP 24576:VYwzFmPnNN7q+iuO5Mv83ZsS5gyg7TzQbCk66Yjzxi:tz41NW+rO2cbCX9i
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	program2.exe

Executes dropped EXE 4 IoCs

pid	Process
2752	wlyx906530.exe
4908	wlyx906530.exe
4928	wlyx906530.exe
5016	wlyx906530.exe

Loads dropped DLL 3 IoCs

pid	Process
3724	program2.exe
3724	program2.exe
3724	program2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	wlyx906530.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3724	program2.exe
3724	program2.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe
5016	wlyx906530.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4908	wlyx906530.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2752	wlyx906530.exe
2752	wlyx906530.exe
4928	wlyx906530.exe
4928	wlyx906530.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 2752	3724	program2.exe	83
PID 3724 wrote to memory of 2752	3724	program2.exe	83
PID 3724 wrote to memory of 2752	3724	program2.exe	83
PID 3724 wrote to memory of 4908	3724	program2.exe	84
PID 3724 wrote to memory of 4908	3724	program2.exe	84
PID 3724 wrote to memory of 4908	3724	program2.exe	84
PID 3724 wrote to memory of 4928	3724	program2.exe	85
PID 3724 wrote to memory of 4928	3724	program2.exe	85
PID 3724 wrote to memory of 4928	3724	program2.exe	85
PID 3724 wrote to memory of 5016	3724	program2.exe	86
PID 3724 wrote to memory of 5016	3724	program2.exe	86
PID 3724 wrote to memory of 5016	3724	program2.exe	86

C:\Users\Admin\AppData\Local\Temp\zmxy3hmnxgq\data\program2.exe
"C:\Users\Admin\AppData\Local\Temp\zmxy3hmnxgq\data\program2.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Users\Admin\AppData\Roaming\ÓÎÏ·\wlyx906530\wlyx906530.exe
  "C:\Users\Admin\AppData\Roaming\ÓÎÏ·\wlyx906530\wlyx906530.exe" SW_SHOWNORMAL
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2752
- C:\Users\Admin\AppData\Roaming\ÓÎÏ·\wlyx906530\wlyx906530.exe
  "C:\Users\Admin\AppData\Roaming\ÓÎÏ·\wlyx906530\wlyx906530.exe" /ShowDeskTop
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:4908
- C:\Users\Admin\AppData\Roaming\ÓÎÏ·\wlyx906530\wlyx906530.exe
  "C:\Users\Admin\AppData\Roaming\ÓÎÏ·\wlyx906530\wlyx906530.exe" /autorun /setuprun
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4928
- C:\Users\Admin\AppData\Roaming\ÓÎÏ·\wlyx906530\wlyx906530.exe
  "C:\Users\Admin\AppData\Roaming\ÓÎÏ·\wlyx906530\wlyx906530.exe" /setupsucc
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx40E3.tmp\FindProcDLL.dll
Size 3KB
SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
MD5 8614c450637267afacad1645e23ba24a
SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx40E3.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

lander.ini

Path C:\Users\Admin\AppData\Roaming\ÓÎÏ·\wlyx906530\lander.ini
Size 394B
SHA256 5c00773caa4d1ecbf2bd35d5244999027c82d315b22c3d578df7f2a18e7d352c
MD5 c0ed403868ea0bd3a4e27d5febb4aa89
SHA1 edc777c980c9aa0ac645aaa0998f826dd6a826b0
SHA512 e646c66d87c44c8eaab8a3056e317abd50400e590ff0bf36ce5f7003afabebfd2e7ee0e740b800086bd348b940bbaecd19278d927987d462339b2e97ce46155e
MD5 SHA1 SHA512

Submit Download

wlyx906530.exe

Path C:\Users\Admin\AppData\Roaming\ÓÎÏ·\wlyx906530\wlyx906530.exe
Size 1.0MB
SHA256 37f89cce104b6a196ec110439b2d48f80f5c1eb93660dd0d77efda52f1aa3314
MD5 c36c6bb3e010e833465057a7da5fd62b
SHA1 6f5c63a875698b4b99d194e9bbd9a672a5d770f4
SHA512 4ec6a50a2c29b171ef3a025be0979c19816bbea5823cc9024231ab8023a55d91436f21c585e6fc8454d0fdf55136dc329a7d3b0c0d966c789c2a39690cbbf1d8
SSDEEP 24576:pD1hfUpRmLGVQ9JQeYITPZTfbC5dIx7xK1UwXsPhQ:vupRUGVaJbYsx6571Ug2hQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lander.ini

Path C:\Users\Admin\AppData\Roaming\游戏\wlyx906530\Lander.ini
Size 66B
SHA256 4885a9d24f5b34e7d908f9a871f7a6605a7addfbb029fe15234fd4aa8d6aa55e
MD5 568beac60d835bc166fe8245d55fbb23
SHA1 2a2bd2bbb6f97114619c5b64a3370d27a94747b8
SHA512 246135102983779f5ba2e818899807d727138df43526a2b14fbf5c5a31796152581345cb723964fcaf67c79843058791f1ce841b66b40b6f2ea734c106f03a32
MD5 SHA1 SHA512

Submit Download

Lander.ini

Path C:\Users\Admin\AppData\Roaming\游戏\wlyx906530\Lander.ini
Size 66B
SHA256 31b8b978f80e5c8481b537f46b087b25e69e1c3bf396ef8e41458d55ea4a17af
MD5 a26bd8bcdafa0d08f74c1ea213987178
SHA1 4e6924372020b87ba5d7b4af447ec9e7b4743ea0
SHA512 1c1d0bcbad222de8d2c411e5270702ff41c66cefbdad7ca47a96b11d9fb193b89d64f5031b3351c2861873f715937d504cd11d3b41e53567e6be0e5138ad9fea
MD5 SHA1 SHA512

Submit Download

Lander.ini

Path C:\Users\Admin\AppData\Roaming\游戏\wlyx906530\Lander.ini
Size 105B
SHA256 2d90acc86d520d59e3515fdf288d7754b943742420d4318f1ce36ca21452df96
MD5 cef822a0fbd4c5eee25eba367b70c409
SHA1 a2bee010a9ea07c2c8500a50f7f4a2d6c1157874
SHA512 10fd066a96309b87a7cd1cd603005d18e47d6089ad2da7d9466f9d50f872b830747232e1246134161189e5ca3810e279b3371e4bb101b8e922e6d0d292a1882f
MD5 SHA1 SHA512

Submit Download

memory/2752-52-0x0000000002E40000-0x0000000002E41000-memory.dmp

Download

memory/2752-63-0x0000000002E40000-0x0000000002E41000-memory.dmp

Download

memory/3724-14-0x00000000022B0000-0x00000000022B3000-memory.dmp

Download

memory/3724-15-0x00000000022B1000-0x00000000022B2000-memory.dmp

Download

memory/3724-62-0x00000000022B1000-0x00000000022B2000-memory.dmp

Download