fatalrat | 9005cc0bc07d213f5691fe31f65b686b6f73a66b1117c2020941c44d53c88df9

Analysis

max time kernel
424s
max time network
1202s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b6f99.msi
Size

9.2MB
MD5

99606454c555b45ccf7d94e9ecd73cee
SHA1

5f90e81883ffe92fe903b2150c2690eedc2bbed4
SHA256

9005cc0bc07d213f5691fe31f65b686b6f73a66b1117c2020941c44d53c88df9
SHA512

cbde49abf9744fb0eff5e09439f030caf166f717cb25bda41a361cb020a86abefc7becee1f8dbd8a0977dce328dc606a2e63d6a17ad1deb276b6fd6d2dde92e8
SSDEEP

196608:CWxLkNZONktVDrKfuNL2WO/2eCr4hUQQAcLdu9FtVy7QGO8m:CELkNZONk7r7AW2ichTQTiUg

Score

10^/10

fatalrat bootkit infostealer persistence privilege_escalation rat upx

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 2 IoCs

rat infostealer

Processes:

resource	yara_rule
behavioral2/memory/1548-265-0x0000000002850000-0x000000000287A000-memory.dmp	fatalrat
behavioral2/memory/1920-293-0x00000000023B0000-0x00000000023DA000-memory.dmp	fatalrat

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023525-226.dat	upx
behavioral2/memory/3936-238-0x0000000000DA0000-0x0000000001343000-memory.dmp	upx
behavioral2/memory/3936-305-0x0000000000DA0000-0x0000000001343000-memory.dmp	upx
behavioral2/memory/3936-319-0x0000000000DA0000-0x0000000001343000-memory.dmp	upx
behavioral2/memory/3936-320-0x0000000000DA0000-0x0000000001343000-memory.dmp	upx
behavioral2/memory/3936-324-0x0000000000DA0000-0x0000000001343000-memory.dmp	upx
behavioral2/memory/3936-329-0x0000000000DA0000-0x0000000001343000-memory.dmp	upx

Blocklisted process makes network request 5 IoCs

Processes:

msiexec.exeMsiExec.exe

flow	pid	Process
4	3924	msiexec.exe
14	3924	msiexec.exe
19	3924	msiexec.exe
27	3924	msiexec.exe
46	3492	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

WPS.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	WPS.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

thelper.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	thelper.exe

Drops file in Windows directory 23 IoCs

Processes:

msiexec.exe

description	ioc	Process
File created	C:\Windows\Installer\e57f721.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA80.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE9E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE9F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFB9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI143.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI142.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFADF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCE3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD52.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDC0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDFF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI153.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5379F1F6-582A-4EEA-8F4B-3BA41AF5550E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI37.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57f721.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF80C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF993.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE2F.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Executes dropped EXE 5 IoCs

Processes:

MSI143.tmpMSI142.tmpthelper.exeWPS.exethelper.exe

pid	Process
1256	MSI143.tmp
4328	MSI142.tmp
1548	thelper.exe
3936	WPS.exe
1920	thelper.exe

Loads dropped DLL 41 IoCs

Processes:

MsiExec.exeMsiExec.exethelper.exethelper.exe

pid	Process
3492	MsiExec.exe
3492	MsiExec.exe
3492	MsiExec.exe
3492	MsiExec.exe
3492	MsiExec.exe
3492	MsiExec.exe
3492	MsiExec.exe
3492	MsiExec.exe
3492	MsiExec.exe
3492	MsiExec.exe
3492	MsiExec.exe
1868	MsiExec.exe
1868	MsiExec.exe
3492	MsiExec.exe
1548	thelper.exe
1548	thelper.exe
1548	thelper.exe
1548	thelper.exe
1548	thelper.exe
1548	thelper.exe
1548	thelper.exe
1548	thelper.exe
1548	thelper.exe
1548	thelper.exe
1548	thelper.exe
1548	thelper.exe
1548	thelper.exe
1548	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Processes:

msiexec.exe

pid	Process
3924	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000095515e1ae5238f530000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000095515e1a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090095515e1a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d95515e1a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000095515e1a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

thelper.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	thelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	thelper.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MsiExec.exemsiexec.exethelper.exe

pid	Process
3492	MsiExec.exe
3492	MsiExec.exe
4580	msiexec.exe
4580	msiexec.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe
1920	thelper.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	Process
Token: SeShutdownPrivilege	3924	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3924	msiexec.exe
Token: SeSecurityPrivilege	4580	msiexec.exe
Token: SeCreateTokenPrivilege	3924	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3924	msiexec.exe
Token: SeLockMemoryPrivilege	3924	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3924	msiexec.exe
Token: SeMachineAccountPrivilege	3924	msiexec.exe
Token: SeTcbPrivilege	3924	msiexec.exe
Token: SeSecurityPrivilege	3924	msiexec.exe
Token: SeTakeOwnershipPrivilege	3924	msiexec.exe
Token: SeLoadDriverPrivilege	3924	msiexec.exe
Token: SeSystemProfilePrivilege	3924	msiexec.exe
Token: SeSystemtimePrivilege	3924	msiexec.exe
Token: SeProfSingleProcessPrivilege	3924	msiexec.exe
Token: SeIncBasePriorityPrivilege	3924	msiexec.exe
Token: SeCreatePagefilePrivilege	3924	msiexec.exe
Token: SeCreatePermanentPrivilege	3924	msiexec.exe
Token: SeBackupPrivilege	3924	msiexec.exe
Token: SeRestorePrivilege	3924	msiexec.exe
Token: SeShutdownPrivilege	3924	msiexec.exe
Token: SeDebugPrivilege	3924	msiexec.exe
Token: SeAuditPrivilege	3924	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3924	msiexec.exe
Token: SeChangeNotifyPrivilege	3924	msiexec.exe
Token: SeRemoteShutdownPrivilege	3924	msiexec.exe
Token: SeUndockPrivilege	3924	msiexec.exe
Token: SeSyncAgentPrivilege	3924	msiexec.exe
Token: SeEnableDelegationPrivilege	3924	msiexec.exe
Token: SeManageVolumePrivilege	3924	msiexec.exe
Token: SeImpersonatePrivilege	3924	msiexec.exe
Token: SeCreateGlobalPrivilege	3924	msiexec.exe
Token: SeBackupPrivilege	408	vssvc.exe
Token: SeRestorePrivilege	408	vssvc.exe
Token: SeAuditPrivilege	408	vssvc.exe
Token: SeBackupPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe
Token: SeTakeOwnershipPrivilege	4580	msiexec.exe
Token: SeRestorePrivilege	4580	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid	Process
3924	msiexec.exe
3924	msiexec.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

msiexec.exethelper.exe

description	pid	Process	procid_target
PID 4580 wrote to memory of 1060	4580	msiexec.exe	99
PID 4580 wrote to memory of 1060	4580	msiexec.exe	99
PID 4580 wrote to memory of 3492	4580	msiexec.exe	101
PID 4580 wrote to memory of 3492	4580	msiexec.exe	101
PID 4580 wrote to memory of 3492	4580	msiexec.exe	101
PID 4580 wrote to memory of 1868	4580	msiexec.exe	102
PID 4580 wrote to memory of 1868	4580	msiexec.exe	102
PID 4580 wrote to memory of 1868	4580	msiexec.exe	102
PID 4580 wrote to memory of 1256	4580	msiexec.exe	103
PID 4580 wrote to memory of 1256	4580	msiexec.exe	103
PID 4580 wrote to memory of 1256	4580	msiexec.exe	103
PID 4580 wrote to memory of 4328	4580	msiexec.exe	104
PID 4580 wrote to memory of 4328	4580	msiexec.exe	104
PID 4580 wrote to memory of 4328	4580	msiexec.exe	104
PID 1548 wrote to memory of 1920	1548	thelper.exe	107
PID 1548 wrote to memory of 1920	1548	thelper.exe	107
PID 1548 wrote to memory of 1920	1548	thelper.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6b6f99.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3924

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1060
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A404050F5EF695F347066431EE2BF1DD
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 659EDC8724B35300EDCAA495B984B352 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1868
- C:\Windows\Installer\MSI143.tmp
  "C:\Windows\Installer\MSI143.tmp" /DontWait "C:\ProgramData\Microsoft\MF\thelper.exe"
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\Installer\MSI142.tmp
  "C:\Windows\Installer\MSI142.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\WPS.exe"
  2⤵
  - Executes dropped EXE
  PID:4328

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:408

C:\ProgramData\Microsoft\MF\thelper.exe
"C:\ProgramData\Microsoft\MF\thelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\thelper.exe
  "C:\Users\Admin\AppData\Local\thelper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1920

C:\Users\Admin\AppData\Roaming\WPS.exe
"C:\Users\Admin\AppData\Roaming\WPS.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57f724.rbs

Filesize
377KB

MD5
4da763a88e7c8dcaa77161f006e25bb1

SHA1
1617bd42bd92a82b4a42548c316c8ebdd6143ca1

SHA256
fe1294c7c691c9a339e16b409f4c7c3cc824d8ac901415895edbd0acd8882478

SHA512
0782c7df8eed46d4adf23b80ae2d22d119d95589e2d62d9a77dc158dd9aad25ee8286333b561b6bd1e4c867aae44d7836f97392dd85aaafe40e74e9b6a3ebfb8

Download Submit
C:\ProgramData\Microsoft\MF\Mi.jpg

Filesize
214KB

MD5
7dc8e6bde9ddc21461cc07e0e0ab6c66

SHA1
403de5313b419b17c10a214725d4769ab6e224e7

SHA256
958782d86a36d3d9e3c878d1d5880821bf005625095d67ba06f68ca1d076f7ed

SHA512
bf225ca55e61c4d8ba5b0feeed64a4a7568aa7c5ada3d67348b4da0d254773d33914542ff858b0540454d3b51ef25ff6f8db8e63c64ae5b036433997cd850765

Download Submit
C:\ProgramData\Microsoft\MF\XLFSIO.dll

Filesize
900KB

MD5
a06090c5f2d3df2cedc51cc99e19e821

SHA1
701ac97c2fd140464b234f666a0453d058c9fabf

SHA256
64ffdffb82fc649e6847b3c4f8678d9cca0d5117fa54c9abbb746625d3feef89

SHA512
541804db74a25fc5f50801f23b4d9f2be788d3c95d3d23dd8098f4c8888d1fc808e6eb6959c458965c639ea28b594a87dff7f3a89c4750c109b29b573c4535cf

Download Submit
C:\ProgramData\Microsoft\MF\XLFSIO2.dll

Filesize
209KB

MD5
1bc7af7a8512cf79d4f0efc5cb138ce3

SHA1
68fd202d9380cacd2f8e0ce06d8df1c03c791c5b

SHA256
ef474b18f89310c067a859d55abd4e4f42fdac732e49eafe4246545e36872a62

SHA512
84de4d193d22a305be2ba28fc67bd1cccf83616cead721e57347f1b2e0736d351fef1abf168f7914caa1bcc7a72db43769991016673cd4646def544802ee8960

Download Submit
C:\ProgramData\Microsoft\MF\XLGraphic.dll

Filesize
730KB

MD5
74c75ae5b97ad708dbe6f69d3a602430

SHA1
a02764d99b44ce4b1d199ef0f8ce73431d094a6a

SHA256
89fbb6b1ca9168a452e803dbdc6343db7c661ad70860a245d76b3b08830156e2

SHA512
52c5f7e00dffb1c0719d18184da2cc8ec2ad178b222775f167b87320f0683a3c2846e30190bc506f12d14c07fa45896935b3d4ac396baa14d7564996e35c2ada

Download Submit
C:\ProgramData\Microsoft\MF\XLLuaRuntime.dll

Filesize
249KB

MD5
5362cb2efe55c6d6e9b51849ec0706b2

SHA1
d91acbe95dedc3bcac7ec0051c04ddddd5652778

SHA256
1d7519acca9c8a013c31af2064fbc599a0b14cfd1dfb793a345fab14045fed40

SHA512
dbd591c3d0b9847d9cef59277c03ec89e246db0e54b58fbbe9d492b75cdcb32d75444012cdfb1c77376d15db7fde1f74e694d2487c481ce29a2133342b91e1f5

Download Submit
C:\ProgramData\Microsoft\MF\XLUE.dll

Filesize
2.4MB

MD5
0abbe96e1f7a254e23a80f06a1018c69

SHA1
0b83322fd5e18c9da8c013a0ed952cffa34381ae

SHA256
10f099f68741c179d5ad60b226d15233bb02d73f84ce51a5bbbbc4eb6a08e9d4

SHA512
2924e1e11e11bd655f27eb0243f87002a50a2d4b80e0b0e3ad6fd4c3d75c44222fab426fcaa695881b0093babf544e8aeee50a065ea92274145b0f88b1db0c58

Download Submit
C:\ProgramData\Microsoft\MF\ic.dll

Filesize
165KB

MD5
1fcd1d41cd1d799989c4d9b1d7b7be07

SHA1
14f762898c75356519702817804ddf6fb95b7ea2

SHA256
8ac99c6716bd235986cad57cc30602c9cb5f15685971b93c77a36e70de5a3d44

SHA512
d8f601d6d7694b339ed931ff48899844bbe7e52d0b2df725f1134b7cfd14baa61c4fdc54f27d574479cca554a2c8a9c87eb764974864411ce72a467e802eb637

Download Submit
C:\ProgramData\Microsoft\MF\libexpat.dll

Filesize
668KB

MD5
5ff790879aab8078884eaac71affeb4a

SHA1
59352663fdcf24bb01c1f219410e49c15b51d5c5

SHA256
cceca70f34bbcec861a02c3700de79ea17d80c0a7b9f33d7edd1357a714e0f2f

SHA512
34fbaffc48912e3d3fa2d224e001121e8b36f5be7284a33eb31d306b9a5c00de6e23a9fdc1a17a61fb1371768f0b0e30b9c6e899a08c735fc70482d5aa8ea824

Download Submit
C:\ProgramData\Microsoft\MF\libpng13.dll

Filesize
157KB

MD5
bb1922dfbdd99e0b89bec66c30c31b73

SHA1
f7a561619c101ba9b335c0b3d318f965b8fc1dfb

SHA256
76457f38cbbdd3dce078a40d42d9ac0dc26ae1c4bb68ab9c880eb7ffb400fd99

SHA512
3054574dd645feb1468cee53db2fd456e4f923eaf5fd686557a01c72c0572b19d70f3885d47fe42e97cdf7ccc2c674a6e966ff19668907cf7828e0a943cf474a

Download Submit
C:\ProgramData\Microsoft\MF\mt.dll

Filesize
1.5MB

MD5
bfaa6c11ad36cb958d175f3d4740c90d

SHA1
2fe774c4e7e61404b0e78341823248fbc1ccf1b2

SHA256
7ad42985ab304dcd65ba10186e0a0892dc55303236eef902bdc2f89dbbae10dc

SHA512
8d47f98674f3303d8213dd80979d9e2f4114e7fea98d0695fb4bb7a4fb47491d9509f539c869da97906923a6e39c97e09338470d67587c91d8ec3b7c7be5a0e5

Download Submit
C:\ProgramData\Microsoft\MF\thelper.exe

Filesize
226KB

MD5
ffbed32e4009acd7fadcaa4bf1bdd898

SHA1
7485fcf366f7b3e61afc02130f296e0016d342c3

SHA256
79b496701e7a68dea3406f01b81e4d05fa484597a5a711889875f1cfb743822a

SHA512
320006a900494d77c82013a683b6300f7d578b0a9c6a1597af1a2ba877f61eb546ee85a5e2b640b5944b36f4c8e27ca75e77744e6eb087f51bba2dc64e4cc29f

Download Submit
C:\ProgramData\Microsoft\MF\zlib1.dll

Filesize
62KB

MD5
37163aacc5534fbab012fb505be8d647

SHA1
73de6343e52180a24c74f4629e38a62ed8ad5f81

SHA256
0a6357a8852daaafe7aed300e2f7e69d993cac4156e882baa8a3a56b583255ba

SHA512
c3bed1c9bc58652ed16b162ed16a93cf7479a0492db7e6ea577001dbe859affc0b20387d93d23e06e73f49f395e4c9a5a07680f000ebb82d32269742c16a5242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_16AA5B9B040CB195ADDB70661F18F3C5

Filesize
1KB

MD5
4d54a398a9de3773110b08e3053c6922

SHA1
442e8ad891dc493f3abe3f30a9ed9e76e75ca06e

SHA256
e921a4033d60b79777a57cbfdb802a3ed1e9a09fa900ead5283c02e6fc74f46a

SHA512
ab83a99b7620a790030dd50e0328ff7af71b4d6575914895eff330670b7f279825ad02a5bbe7b71a1305811b4e3b5ab734154bb0269060ccfb3ec2d50424dae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B03113490075047F519A3F760F0FF379_F891537EEBBDBB955ED6C40DCF761C31

Filesize
2KB

MD5
0ba0a57d0973c75a874c8d488b388416

SHA1
49393bb338381be8a85788cbcab5307b4d1c6366

SHA256
98e9408a6fc0de2bb8c77f4a3d1d652f46a9b75ce8500a34c62fdb1199072bd0

SHA512
6a0fbf476942adc34b4b91f6ad5f2aed5a72b956bb99909f1e22fe08168c9853fb3e43038577b98277113dfc14699e4041030ed458d576e525bb98d262e27550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_16AA5B9B040CB195ADDB70661F18F3C5

Filesize
412B

MD5
592250a7b075f99c09d253cb7cb9bc49

SHA1
f030395d42f47aa08ae0a397492c42f7c02c54f1

SHA256
7300a9b35bf28dfd246d1035bfb59c6aba4680b30f635fb58317a763ce8f97aa

SHA512
9d5316b748c8dbeeaf8ab413fc5d5a892a13ae410250646a58086c2d70daef15cd98fab39b6b0b42a7201152e39e46a98af2f3ba49bea54cc5cba447660af9ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B03113490075047F519A3F760F0FF379_F891537EEBBDBB955ED6C40DCF761C31

Filesize
428B

MD5
af58a9cee490db92d9ff6568dd4bcf95

SHA1
21f3719b14470d89a68bd74f8e643aaab12c5c62

SHA256
e5e23f2f03791a213840520d64eefce4f3997caa687dfe442099c6953ed1b087

SHA512
89498f10ed982fba3500f58a3e74c8527f64a2284dd14e81fb389f9534bb2219146e029ddb2be11f4dbc0e41eb1a2c1d6d0a9e9bed2bea4186f76eaf21c9e8ca

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\6696c9562ff508bfba81ef0a\76.20.36\tracking.ini

Filesize
84B

MD5
74420d67d2dfdc7cdb1a4c8936f8a67d

SHA1
c60a68da59dd52f4df2b819e4d384f71a024a6bd

SHA256
10bcf3a86f4b9e87eea67969185af7aab2956ba25355fce1c970c9ad814fcc42

SHA512
c6004ea5ed3d52909df1cc9ac6669f56d76949f48e6295621367ef4e49e1da47cbba5bc0ec83ac9d276a60ebd0ee8d69e533e7bffb8ff7551e7a205cd5c82526

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\6696c9562ff508bfba81ef0a\76.20.36\tracking.ini

Filesize
84B

MD5
529f03618c03e1075846aa46bbf41f37

SHA1
a0797ff44a6de7bbce4185890e4a55081d008b57

SHA256
46b42de4170ca052cef2a5f76469bc3fdb4e560b725914c024fecd6840049bde

SHA512
4f259d79f257ac919a5ab67281e087d230306becba04fab0e72ac4ff836f733495725f2d466558420cd11be24c86d2d716f8de03d47d88f4bb3b01ea02ea727d

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\6696c9562ff508bfba81ef0a\76.20.36\{E0E9B42B-64F0-4739-904F-542DBF7B15E0}.session

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\WPS.exe

Filesize
2.9MB

MD5
b52ba2b99108c496389ae5bb81fa6537

SHA1
9073d8c4a1968be24357862015519f2afecd833a

SHA256
c6ac7d9add40b913112b265d4f366d9ef80bbd711049db085fc750fcad4e14d8

SHA512
6637506ee80d359e729e0011b97e8d827e14356393193247f502b7fcfbbca249dc045b8acfe4b31ce462468f421dc5d9a4e31183bedb66c45a9aa43c01f81397

Download Submit
C:\Windows\Installer\MSI142.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
C:\Windows\Installer\MSIF80C.tmp

Filesize
770KB

MD5
356fc2c181cc37e3f8ae4d6b855ebfcb

SHA1
2ead1e69f14099ae33a3216a9312c88007b73cd1

SHA256
c92b2d9623f19f8acfeac5fd894346515631ebb590e68f22c40a35fbacbef03c

SHA512
74ea73d3206ba1c6f1963caa4866589fe86636f68815c74733644ad6c4913de3f1399770f6095a48c9d94a7d934072d8d8b409a393de644265f6e456455dcebd

Download Submit
C:\Windows\Installer\MSIF993.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIFADF.tmp

Filesize
897KB

MD5
6189cdcb92ab9ddbffd95facd0b631fa

SHA1
b74c72cefcb5808e2c9ae4ba976fa916ba57190d

SHA256
519f7ac72beba9d5d7dcf71fcac15546f5cfd3bcfc37a5129e63b4e0be91a783

SHA512
ee9ce27628e7a07849cd9717609688ca4229d47579b69e3d3b5b2e7c2433369de9557ef6a13fa59964f57fb213cd8ca205b35f5791ea126bde5a4e00f6a11caf

Download Submit
C:\Windows\Installer\MSIFE9F.tmp

Filesize
187KB

MD5
f11e8ec00dfd2d1344d8a222e65fea09

SHA1
235ed90cc729c50eb6b8a36ebcd2cf044a2d8b20

SHA256
775037d6d7de214796f2f5850440257ae7f04952b73538da2b55db45f3b26e93

SHA512
6163dd8fd18b4520d7fda0986a80f2e424fe55f5d65d67f5a3519a366e53049f902a08164ea5669476100b71bb2f0c085327b7c362174cb7a051d268f10872d3

Download Submit
memory/1548-241-0x0000000000D60000-0x0000000000E68000-memory.dmp

Filesize
1.0MB

Download
memory/1548-282-0x0000000072E20000-0x0000000073037000-memory.dmp

Filesize
2.1MB

Download
memory/1548-281-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/1548-261-0x0000000002810000-0x0000000002841000-memory.dmp

Filesize
196KB

Download
memory/1548-254-0x0000000000CD0000-0x0000000000D05000-memory.dmp

Filesize
212KB

Download
memory/1548-265-0x0000000002850000-0x000000000287A000-memory.dmp

Filesize
168KB

Download
memory/1548-239-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/1548-244-0x0000000000850000-0x000000000088F000-memory.dmp

Filesize
252KB

Download
memory/1920-293-0x00000000023B0000-0x00000000023DA000-memory.dmp

Filesize
168KB

Download
memory/1920-298-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/1920-299-0x00000000729F0000-0x0000000072C07000-memory.dmp

Filesize
2.1MB

Download
memory/1920-283-0x0000000000800000-0x0000000000908000-memory.dmp

Filesize
1.0MB

Download
memory/1920-285-0x0000000000690000-0x00000000006CF000-memory.dmp

Filesize
252KB

Download
memory/1920-289-0x0000000002360000-0x0000000002391000-memory.dmp

Filesize
196KB

Download
memory/1920-287-0x0000000000910000-0x0000000000945000-memory.dmp

Filesize
212KB

Download
memory/3936-238-0x0000000000DA0000-0x0000000001343000-memory.dmp

Filesize
5.6MB

Download
memory/3936-305-0x0000000000DA0000-0x0000000001343000-memory.dmp

Filesize
5.6MB

Download
memory/3936-319-0x0000000000DA0000-0x0000000001343000-memory.dmp

Filesize
5.6MB

Download
memory/3936-320-0x0000000000DA0000-0x0000000001343000-memory.dmp

Filesize
5.6MB

Download
memory/3936-324-0x0000000000DA0000-0x0000000001343000-memory.dmp

Filesize
5.6MB

Download
memory/3936-329-0x0000000000DA0000-0x0000000001343000-memory.dmp

Filesize
5.6MB

Download