b163ccbeea7c7b4faec7076b8006fa32a6e780bc09f6f91a6fed3056e9989d0c

General

Target

b163ccbeea7c7b4faec7076b8006fa32a6e780bc09f6f91a6fed3056e9989d0c.exe
Size

4.9MB
MD5

53ccedb45865a57313ba99fdeb6a2eae
SHA1

2e8a6e72b73383cf4e1090ecad5a792d68b22dd7
SHA256

b163ccbeea7c7b4faec7076b8006fa32a6e780bc09f6f91a6fed3056e9989d0c
SHA512

07510fd856014306dd837a12b101c6be6c64fbd81b4b0de5bfd6e219b79117e428f307bbc7ef8e7adff6aed378e0fe4558042d410bb225c53da761b171af384e
SSDEEP

98304:qItRQyvhzvcy4/YyqttymOj5sEKRxwiTjWIzAZIzxCJwPmNH++DzLA4+NG1:nhzkv/3GtrOIxr2I8ezxSomNHTDzL31

Score

7^/10

bootkit discovery persistence vmprotect

Malware Config

Signatures

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2956-39-0x0000000000400000-0x000000000131D000-memory.dmp	vmprotect
behavioral1/memory/2956-40-0x0000000000400000-0x000000000131D000-memory.dmp	vmprotect
behavioral1/memory/2956-41-0x0000000000400000-0x000000000131D000-memory.dmp	vmprotect
behavioral1/memory/2956-42-0x0000000000400000-0x000000000131D000-memory.dmp	vmprotect
behavioral1/memory/2956-44-0x0000000000400000-0x000000000131D000-memory.dmp	vmprotect
behavioral1/memory/2956-45-0x0000000000400000-0x000000000131D000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b163ccbeea7c7b4faec7076b8006fa32a6e780bc09f6f91a6fed3056e9989d0c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b163ccbeea7c7b4faec7076b8006fa32a6e780bc09f6f91a6fed3056e9989d0c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2956	b163ccbeea7c7b4faec7076b8006fa32a6e780bc09f6f91a6fed3056e9989d0c.exe
2956	b163ccbeea7c7b4faec7076b8006fa32a6e780bc09f6f91a6fed3056e9989d0c.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2956	b163ccbeea7c7b4faec7076b8006fa32a6e780bc09f6f91a6fed3056e9989d0c.exe
2956	b163ccbeea7c7b4faec7076b8006fa32a6e780bc09f6f91a6fed3056e9989d0c.exe
2956	b163ccbeea7c7b4faec7076b8006fa32a6e780bc09f6f91a6fed3056e9989d0c.exe

C:\Users\Admin\AppData\Local\Temp\b163ccbeea7c7b4faec7076b8006fa32a6e780bc09f6f91a6fed3056e9989d0c.exe
"C:\Users\Admin\AppData\Local\Temp\b163ccbeea7c7b4faec7076b8006fa32a6e780bc09f6f91a6fed3056e9989d0c.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2956-36-0x0000000000B59000-0x0000000000E43000-memory.dmp

Filesize
2.9MB

Download
memory/2956-34-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2956-32-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2956-30-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2956-29-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2956-27-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2956-24-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2956-22-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2956-19-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-17-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-14-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2956-12-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2956-9-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2956-7-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2956-5-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2956-4-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2956-2-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2956-0-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2956-39-0x0000000000400000-0x000000000131D000-memory.dmp

Filesize
15.1MB

Download
memory/2956-40-0x0000000000400000-0x000000000131D000-memory.dmp

Filesize
15.1MB

Download
memory/2956-41-0x0000000000400000-0x000000000131D000-memory.dmp

Filesize
15.1MB

Download
memory/2956-42-0x0000000000400000-0x000000000131D000-memory.dmp

Filesize
15.1MB

Download
memory/2956-43-0x0000000000B59000-0x0000000000E43000-memory.dmp

Filesize
2.9MB

Download
memory/2956-44-0x0000000000400000-0x000000000131D000-memory.dmp

Filesize
15.1MB

Download
memory/2956-45-0x0000000000400000-0x000000000131D000-memory.dmp

Filesize
15.1MB

Download
memory/2956-46-0x0000000000B59000-0x0000000000E43000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads