243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c

General

Target

243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe
Size

6.0MB
MD5

db692724da053d4853cc4ad602da9edc
SHA1

29ee8e69e979f9a5efb8c2ad10c6c5dd0570b54b
SHA256

243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c
SHA512

1ebce4fd3369a0b878d59799bbd5c92247496f8b9873d9f5d7b985a3b592dda7182d8ee2fc259fb6a1ecbfdb9ac5a541fbf6461ae4494ca22bd16a0d0ad66bed
SSDEEP

98304:fbdhDqohDS1F+CRcB27OgUWZHw8VQjr+/bJBAUZLb:fbdhDD23a2sWKjr+TJVX

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4972	243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4972-0-0x0000000001150000-0x000000000115B000-memory.dmp	upx
behavioral2/memory/4972-8-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-49-0x0000000001150000-0x000000000115B000-memory.dmp	upx
behavioral2/memory/4972-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-33-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-31-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-16-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-14-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-10-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-6-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4972-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4972	243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe
4972	243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe
4972	243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 716	4972	243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe	113
PID 4972 wrote to memory of 716	4972	243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe	113

C:\Users\Admin\AppData\Local\Temp\243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe
"C:\Users\Admin\AppData\Local\Temp\243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://changkongbao.lanzouq.com/ikW9T1cfeg5e
  2⤵
  PID:716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4416,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
1⤵
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=4404,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
1⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --field-trial-handle=3924,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:1
1⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5152,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
1⤵
PID:180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5312,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
1⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --field-trial-handle=5448,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
1⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=5628,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230421.lib

Filesize
1.5MB

MD5
ef48d7cc52338513cc0ce843c5e3916b

SHA1
20965d86b7b358edf8b5d819302fa7e0e6159c18

SHA256
835bfef980ad0cedf10d8ade0cf5671d9f56062f2b22d0a0547b07772ceb25a8

SHA512
fd4602bd487eaad5febb5b3e9d8fe75f4190d1e44e538e7ae2d2129087f35b72b254c85d7335a81854aa2bdb4f0f2fa22e02a892ee23ac57b78cdd03a79259b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\·½°¸.ini

Filesize
10KB

MD5
842d9e10867153ad73a1a80d79afef13

SHA1
33a49d893273182e8aba6e9531c3077d4ab86516

SHA256
2823197bddf0203ea011003a4e70f2687da234a3388b5090a76da2c2562d33e4

SHA512
e6e10f63c7d3e65358bd6e66a7328f7d06d096b2ed936cd4504cfb8c6b5f4081dd55884bb915191156965b0eb9b3fda6a97b5b1a1eee45d59a41a4e375d1e518

Download Submit
C:\Users\Admin\AppData\Local\Temp\·½°¸.ini

Filesize
8KB

MD5
16ef8177433976c14d23f839a8c1152a

SHA1
2b653ca841498be9292cbbc8b5119504e225f56d

SHA256
2a30dc50f2e6e73b059d7419b34924114bffcfa8d99f7703bfbdd4f9e5da8855

SHA512
9cccf0eb97b898988e5da63584e195528dd3a0f34d0608844a33c6ac5928d83c8159151a7a15d5382a10114b819cb72d8c5840d254d9ac1023ad6ac22ac4833e

Download Submit
C:\Users\Admin\AppData\Local\Temp\¿ì½Ý·¢ÑÔ·½°¸.txt

Filesize
189B

MD5
322f59ce015ff2f1f00ecbe4fdfce380

SHA1
eb4756a5bb023f6d1feacdbeac6e94013e15d5b0

SHA256
c96ef901d8f23cb7626ef980c4cf5bece7aafeef9b2b8b28829d3a11a51562c1

SHA512
2610ce1c0a55da67faa9ddaca26529a87bf5ebc6706621682d54024fa887ca9cd54cdc5b854f8b79ea99b02a5277d6931f633fa876107d9ec1bf503bee23a02c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.ini

Filesize
103B

MD5
62417cec773969a0ad264d73e8c06dd5

SHA1
aaa287afa9bd45430a7708a67fdbca8984a55d92

SHA256
b0600c7ab1c9a6c937713e8f71d712a1f6f9d6991a6078f1a36f420a3f07846b

SHA512
a3788224ab0b1f3adb664820f0d6cb2cf2e38d5b0d09ed8678774b712a569e33d24bf1039edd941fa16ee765e36d348808cfd7b96a5f89b9d9756a481903a161

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.ini

Filesize
246B

MD5
b06ddcfdb64cc28ca0a0ef609de5f05f

SHA1
bd95d141935795e249d2ab00824839fd42c8f505

SHA256
da0a5d79dc6a120811b556885b704f9fd158b1f19dd5a9c595719feb56065f00

SHA512
a1dd3cc527ce6a6c4b0ea2c369d4370f6f1bf332c9255e1a8eebfd5986c133dacc2e6c6a55071e5bcf4724f37ff2920f2e17567ca32571e664b458e526be72b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.ini

Filesize
260B

MD5
924bf7a4ce305dad87743ba3c5773aa9

SHA1
12d0fddb472394b23e5176ab4ede38974e723b81

SHA256
01faf5e88442653bf38adc145d517f44d3495398e0aa666c7486b7030c126cbd

SHA512
2380c957717d3bc97ae2de96aba9cd3b50a1774eb96dc47840add1b12ee13485ee6cc6c4d30953b8f42d32ae3b02657966229fcbe58a60843df0cbd6170eb44e

Download Submit
memory/4972-16-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-6-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-33-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-31-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-18-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-0-0x0000000001150000-0x000000000115B000-memory.dmp

Filesize
44KB

Download
memory/4972-14-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-10-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-52-0x0000000002A30000-0x0000000002A31000-memory.dmp

Filesize
4KB

Download
memory/4972-55-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/4972-54-0x0000000002A50000-0x0000000002A51000-memory.dmp

Filesize
4KB

Download
memory/4972-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-100-0x0000000006240000-0x0000000006241000-memory.dmp

Filesize
4KB

Download
memory/4972-99-0x0000000006250000-0x0000000006251000-memory.dmp

Filesize
4KB

Download
memory/4972-48-0x0000000001180000-0x0000000001181000-memory.dmp

Filesize
4KB

Download
memory/4972-49-0x0000000001150000-0x000000000115B000-memory.dmp

Filesize
44KB

Download
memory/4972-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-8-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4972-1-0x0000000000400000-0x0000000000A6D000-memory.dmp

Filesize
6.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads