Analysis
- max time kernel
141s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
25/06/2024, 22:33
General
- Target 63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe
- Size 1.4MB
- Sample240625-2gnvssxfpg
- SHA256 63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2
Malware Config
Signatures
- detect oss ak 12 IoCs
oss ak information detected.
- Executes dropped EXE 1 IoCs
- UPX packed file 41 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe"C:\Users\Admin\AppData\Local\Temp\63dda37804a7e693d0c29109a4820266cf1a3d71fe31365124dd37a543c4cea2.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport-524766.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport-524766.dll Bugreport %E9%AA%A8%E5%A4%B4QQ%E7%A9%BA%E9%97%B4%E8%AE%BF%E5%AE%A2%E7%9B%91%E6%8E%A7%E6%8F%90%202⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Bugreport-524766.dll
Bugreport.ini
Bugreport_error.ini
memory/372-80-0x0000000000400000-0x0000000000438000-memory.dmp
memory/372-63-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1568-32-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-16-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-41-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-38-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-36-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-34-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-0-0x0000000000400000-0x0000000000838200-memory.dmp
memory/1568-26-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-24-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-20-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-18-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-49-0x00000000029F0000-0x0000000002A62000-memory.dmp
memory/1568-12-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-10-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-8-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-6-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-3-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-4-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-30-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-28-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-22-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-46-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-14-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-50-0x0000000000400000-0x0000000000838200-memory.dmp
memory/1568-52-0x00000000029F0000-0x0000000002A62000-memory.dmp
memory/1568-54-0x0000000000400000-0x0000000000838200-memory.dmp
memory/1568-45-0x00000000029F0000-0x0000000002A62000-memory.dmp
memory/1568-44-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-43-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-1-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-2-0x0000000010000000-0x000000001003F000-memory.dmp
memory/1568-82-0x0000000000400000-0x0000000000838200-memory.dmp
memory/1568-91-0x0000000000400000-0x0000000000838200-memory.dmp
memory/1568-100-0x0000000000400000-0x0000000000838200-memory.dmp
memory/1568-105-0x0000000000400000-0x0000000000838200-memory.dmp
memory/1568-114-0x0000000000400000-0x0000000000838200-memory.dmp
memory/1568-118-0x0000000000400000-0x0000000000838200-memory.dmp
memory/1568-119-0x0000000000400000-0x0000000000838200-memory.dmp
memory/1568-120-0x0000000000400000-0x0000000000838200-memory.dmp
memory/1568-121-0x0000000000400000-0x0000000000838200-memory.dmp
memory/1568-122-0x0000000000400000-0x0000000000838200-memory.dmp