63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2

General

Target

63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe
Size

1.4MB
MD5

44f03aa6e9f8e6dd2559693582ed5778
SHA1

59d2bccb460b841aa562adabc04b8759cbd0b432
SHA256

63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2
SHA512

9057c16d33d1e7c912563dd0c6a4a127ab36e3ac28af39cb650c19d47b41715f3693d4b0a047ac113ae17847f5e29a829041070c643b253fc121881e66959638
SSDEEP

24576:lit/4ruZ0S7sMWE+bt0hKFXhzJ0WI3OTGgHAtHGRS4T6gigpgdCdg:M5ZZD7NBsFXhGWIOpHAHG8oYC6

Score

9^/10

bootkit oss_ak persistence upx

Malware Config

Signatures

detect oss ak 12 IoCs

oss ak information detected.

oss_ak

Processes:

resource	yara_rule
behavioral2/memory/1568-50-0x0000000000400000-0x0000000000838200-memory.dmp	detect_ak_stuff
behavioral2/memory/1568-54-0x0000000000400000-0x0000000000838200-memory.dmp	detect_ak_stuff
behavioral2/memory/1568-82-0x0000000000400000-0x0000000000838200-memory.dmp	detect_ak_stuff
behavioral2/memory/1568-91-0x0000000000400000-0x0000000000838200-memory.dmp	detect_ak_stuff
behavioral2/memory/1568-100-0x0000000000400000-0x0000000000838200-memory.dmp	detect_ak_stuff
behavioral2/memory/1568-105-0x0000000000400000-0x0000000000838200-memory.dmp	detect_ak_stuff
behavioral2/memory/1568-114-0x0000000000400000-0x0000000000838200-memory.dmp	detect_ak_stuff
behavioral2/memory/1568-118-0x0000000000400000-0x0000000000838200-memory.dmp	detect_ak_stuff
behavioral2/memory/1568-119-0x0000000000400000-0x0000000000838200-memory.dmp	detect_ak_stuff
behavioral2/memory/1568-120-0x0000000000400000-0x0000000000838200-memory.dmp	detect_ak_stuff
behavioral2/memory/1568-121-0x0000000000400000-0x0000000000838200-memory.dmp	detect_ak_stuff
behavioral2/memory/1568-122-0x0000000000400000-0x0000000000838200-memory.dmp	detect_ak_stuff

Executes dropped EXE 1 IoCs

Processes:

Bugreport-524766.dll

pid process

372 Bugreport-524766.dll

pid	process
372	Bugreport-524766.dll

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1568-0-0x0000000000400000-0x0000000000838200-memory.dmp	upx
behavioral2/memory/1568-2-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-1-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-43-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-44-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-45-0x00000000029F0000-0x0000000002A62000-memory.dmp	upx
behavioral2/memory/1568-46-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-41-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-38-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-36-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-34-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-32-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-26-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-24-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-20-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-18-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-49-0x00000000029F0000-0x0000000002A62000-memory.dmp	upx
behavioral2/memory/1568-12-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-10-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-8-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-6-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-3-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-4-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-30-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-28-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-22-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-16-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-14-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral2/memory/1568-50-0x0000000000400000-0x0000000000838200-memory.dmp	upx
behavioral2/memory/1568-52-0x00000000029F0000-0x0000000002A62000-memory.dmp	upx
behavioral2/memory/1568-54-0x0000000000400000-0x0000000000838200-memory.dmp	upx
behavioral2/memory/1568-82-0x0000000000400000-0x0000000000838200-memory.dmp	upx
behavioral2/memory/1568-91-0x0000000000400000-0x0000000000838200-memory.dmp	upx
behavioral2/memory/1568-100-0x0000000000400000-0x0000000000838200-memory.dmp	upx
behavioral2/memory/1568-105-0x0000000000400000-0x0000000000838200-memory.dmp	upx
behavioral2/memory/1568-114-0x0000000000400000-0x0000000000838200-memory.dmp	upx
behavioral2/memory/1568-118-0x0000000000400000-0x0000000000838200-memory.dmp	upx
behavioral2/memory/1568-119-0x0000000000400000-0x0000000000838200-memory.dmp	upx
behavioral2/memory/1568-120-0x0000000000400000-0x0000000000838200-memory.dmp	upx
behavioral2/memory/1568-121-0x0000000000400000-0x0000000000838200-memory.dmp	upx
behavioral2/memory/1568-122-0x0000000000400000-0x0000000000838200-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe

description ioc process

File opened for modification \??\PhysicalDrive0 63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe

pid	process
1568	63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe
1568	63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exeBugreport-524766.dll

pid	process
1568	63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe
1568	63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe
1568	63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe
1568	63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe
372	Bugreport-524766.dll

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe

description	pid	process	target process
PID 1568 wrote to memory of 372	1568	63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe	Bugreport-524766.dll
PID 1568 wrote to memory of 372	1568	63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe	Bugreport-524766.dll
PID 1568 wrote to memory of 372	1568	63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe	Bugreport-524766.dll

C:\Users\Admin\AppData\Local\Temp\63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe
"C:\Users\Admin\AppData\Local\Temp\63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568

C:\Users\Admin\AppData\Local\Temp\data\Bugreport-524766.dll
C:\Users\Admin\AppData\Local\Temp\data\Bugreport-524766.dll Bugreport %E9%AA%A8%E5%A4%B4QQ%E7%A9%BA%E9%97%B4%E8%AE%BF%E5%AE%A2%E7%9B%91%E6%8E%A7%E6%8F%90%20
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:372

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\data\Bugreport-524766.dll
Filesize
164KB

MD5
e3105546c42d458f5e948fafe709e2d6

SHA1
4b5c829757958c1fbf4e04aa3480e23b88c5e487

SHA256
f3dd5612e47e4ace9795322f3c3bde17d11f02df9fdd2a2f474607728c2f13c1

SHA512
c09add59aee3146df488409a1fc078dc26e675cff102e7f928ebaf4bb8d5bf87c7866caa1d8208a4c67c4c5d236a4853b90e936735eec7534ffd0d44d4b513d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\Bugreport.ini
Filesize
112B

MD5
0f3c9acdab0663bb10b483412e2204dc

SHA1
f5f5348aec1279e68c09d405daa7f428dd491421

SHA256
1fec17599f37beb5f1338e6fafcafca8048c745253d12f7ddc8e69044d28776a

SHA512
99f7e8e3b4d8436b44e82c75c4d00a50f2e09ef1a17167c1a4d54d5a2f88788052c78d1b0f234b89dd572721c9c0e0fcdf8a3a20633d11d5172f45f043284e23

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\Bugreport_error.ini
Filesize
133B

MD5
fdf8fb8cbbfbb87d9ac44966ba53678a

SHA1
fd306c570e8c02a66c731d6e054e941a60f64d45

SHA256
0ee6fba0f70dd3be82a7398b5c2564baaf2a346287fe45c79324cab92f62fb9c

SHA512
c37243d5c4d370a041f03b3e54d4111c9d300fff63db7397cae066ec2a86cd829b9e2f41af45a1ecf6701f337068fcf8af45706add719ca13630c478701cf92f

Download Submit
memory/372-80-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/372-63-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1568-32-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-16-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-41-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-38-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-36-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-34-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-0-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download
memory/1568-26-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-24-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-20-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-18-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-49-0x00000000029F0000-0x0000000002A62000-memory.dmp

Filesize
456KB

Download
memory/1568-12-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-10-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-8-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-6-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-3-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-4-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-30-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-28-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-22-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-46-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-14-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-50-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download
memory/1568-52-0x00000000029F0000-0x0000000002A62000-memory.dmp

Filesize
456KB

Download
memory/1568-54-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download
memory/1568-45-0x00000000029F0000-0x0000000002A62000-memory.dmp

Filesize
456KB

Download
memory/1568-44-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-43-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-1-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-2-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1568-82-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download
memory/1568-91-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download
memory/1568-100-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download
memory/1568-105-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download
memory/1568-114-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download
memory/1568-118-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download
memory/1568-119-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download
memory/1568-120-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download
memory/1568-121-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download
memory/1568-122-0x0000000000400000-0x0000000000838200-memory.dmp

Filesize
4.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads