7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

Analysis

max time kernel
108s
max time network
112s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12-09-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

796KB
MD5

4b94b989b0fe7bec6311153b309dfe81
SHA1

bb50a4bb8a66f0105c5b74f32cd114c672010b22
SHA256

7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659
SHA512

fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d
SSDEEP

12288:jHeLH6iTPSE54sgweI9oaQaj3T+piq+77xOZ+eMm:jHeLHdTSEeyoaQaj3apiq+77xd

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
916	BootstrapperV1.19.exe

Executes dropped EXE 1 IoCs

pid	Process
916	BootstrapperV1.19.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
4	pastebin.com
7	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
916	BootstrapperV1.19.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	Bootstrapper.exe
Token: SeDebugPrivilege	916	BootstrapperV1.19.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 916	1792	Bootstrapper.exe	82
PID 1792 wrote to memory of 916	1792	Bootstrapper.exe	82

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.19.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.19.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.19.exe

Filesize
972KB

MD5
90fd25ced85fe6db28d21ae7d1f02e2c

SHA1
e27eff4cd4d383f5c564cce2bd1aaa2ffe4ec056

SHA256
97572bd57b08b59744e4dfe6f93fb96be4002dfe1aa78683771725401776464f

SHA512
1c775cf8dfde037eaa98eb14088c70d74923f0f6a83030a71f2f4c1a4453f6154dab7a4aa175e429860badda3e5e0ae226f3c3e8171332f5962bf36f8aa073fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\DISCORD

Filesize
103B

MD5
487ab53955a5ea101720115f32237a45

SHA1
c59d22f8bc8005694505addef88f7968c8d393d3

SHA256
d64354a111fd859a08552f6738fecd8c5594475e8c03bb37546812a205d0d368

SHA512
468689d98645c9f32813d833a07bbcf96fe0de4593f4f4dc6757501fbce8e9951d21a8aa4a7050a87a904d203f521134328d426d4e6ab9f20e7e759769003b7c

Download Submit
memory/916-18-0x0000011DC2C20000-0x0000011DC2D1A000-memory.dmp

Filesize
1000KB

Download
memory/916-19-0x00007FFE45770000-0x00007FFE46232000-memory.dmp

Filesize
10.8MB

Download
memory/916-20-0x00007FFE45770000-0x00007FFE46232000-memory.dmp

Filesize
10.8MB

Download
memory/916-22-0x00007FFE45770000-0x00007FFE46232000-memory.dmp

Filesize
10.8MB

Download
memory/1792-0-0x00007FFE45773000-0x00007FFE45775000-memory.dmp

Filesize
8KB

Download
memory/1792-1-0x0000016C06170000-0x0000016C0623E000-memory.dmp

Filesize
824KB

Download
memory/1792-2-0x00007FFE45770000-0x00007FFE46232000-memory.dmp

Filesize
10.8MB

Download
memory/1792-4-0x0000016C07EE0000-0x0000016C07F02000-memory.dmp

Filesize
136KB

Download
memory/1792-16-0x00007FFE45770000-0x00007FFE46232000-memory.dmp

Filesize
10.8MB

Download