6c708deec6e5fba99b6dea92fc604417774b3e6a51aae24fcffe2ba1cd96b6a2

General

Target

driver_booster_setup.exe
Size

30.5MB
MD5

e6ce743d5b58b5f1c04ed63b6e9139a1
SHA1

f4c2e6b974d80bb045cfe6956634a1d38acdd569
SHA256

6c708deec6e5fba99b6dea92fc604417774b3e6a51aae24fcffe2ba1cd96b6a2
SHA512

a810a16c18815bd535022ffd95b740d3643ff3535d02a51d4da3f8d71256018bc128a3c44106883c5b4ca54fe2f9a101bfc17d6541d73054f96ad9641523d963
SSDEEP

786432:GtM0UzQosgweW+xseru+y81pDDc83oGdwi0nMQ6CIp0T:sxGQSuyy81p/z9MMQ6CIGT

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	driver_booster_setup.tmp

Executes dropped EXE 2 IoCs

pid	Process
4436	driver_booster_setup.tmp
3272	setup.exe

Loads dropped DLL 2 IoCs

pid	Process
3272	setup.exe
3272	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driver_booster_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driver_booster_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4436	driver_booster_setup.tmp
4436	driver_booster_setup.tmp
4436	driver_booster_setup.tmp
4436	driver_booster_setup.tmp
3272	setup.exe
3272	setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	driver_booster_setup.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3272	setup.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 4436	3876	driver_booster_setup.exe	82
PID 3876 wrote to memory of 4436	3876	driver_booster_setup.exe	82
PID 3876 wrote to memory of 4436	3876	driver_booster_setup.exe	82
PID 4436 wrote to memory of 3272	4436	driver_booster_setup.tmp	83
PID 4436 wrote to memory of 3272	4436	driver_booster_setup.tmp	83
PID 4436 wrote to memory of 3272	4436	driver_booster_setup.tmp	83

C:\Users\Admin\AppData\Local\Temp\driver_booster_setup.exe
"C:\Users\Admin\AppData\Local\Temp\driver_booster_setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Users\Admin\AppData\Local\Temp\is-SUFST.tmp\driver_booster_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-SUFST.tmp\driver_booster_setup.tmp" /SL5="$50296,31285930,139264,C:\Users\Admin\AppData\Local\Temp\driver_booster_setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Users\Admin\AppData\Local\Temp\is-MPOTM.tmp-dbinst\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-MPOTM.tmp-dbinst\setup.exe" "C:\Users\Admin\AppData\Local\Temp\driver_booster_setup.exe" /title="Driver Booster 12" /dbver=12.0.0.308 /eula="C:\Users\Admin\AppData\Local\Temp\is-MPOTM.tmp-dbinst\EULA.rtf" /showlearnmore /pmtproduct /nochromepmt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\IObit\iobitpromotion.ini

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\1727485839\ENGLISH.lng

Filesize
25KB

MD5
e1f018c00b7991f518e5c930e58f8e1d

SHA1
e577eb25a365c698c3020051de477ce1be465a6a

SHA256
d3eb1ff5b56d7a91da5e32be1d6957acd3139186b99ad25ddb0609551123ef7b

SHA512
e19caf280f470f35704c3fe2b47e037c59dc57e845427d0e11b9662fe98e13ed0aae469a83b59ff754fc6739b54530d28421db957eb3d130dd05b4c2dd1c1f5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\appver-ac.ini

Filesize
851B

MD5
cd687c4ece8f3b9e5e40edaea8551ed3

SHA1
efdd86230190f9de2acdbc49571d48ca0cc56656

SHA256
7bc9794251a3f5cc017a8ec79649966586f7f9657088d5217aa55ad034300a5f

SHA512
6ba21698a66ddd44eaa1e9d25e86447fb42197b3394370d41b2903ccde6f79db0a51adcbb7dd844a480c93f9f86a5827170865370ba58337c0628abdc4daba0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MPOTM.tmp-dbinst\libcrypto-1_1.dll

Filesize
1.7MB

MD5
902385503375a1c52787e2c88895e030

SHA1
d3b7fab10695c7c70a611572a7f6593d3a391533

SHA256
078d662af771a3b93c44415447294db364e22710cedc274b685ec639783ac928

SHA512
48cfd677a51691906daddb5034d9098dfe7b09b35507812c6373d17bbec76618b5f914fde2d1b134d89705a03d8135f6d6ac10b87ed5f40e726479c3ed94e89c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MPOTM.tmp-dbinst\libssl-1_1.dll

Filesize
355KB

MD5
beae2f18755207f855bd745a95a0e0df

SHA1
4a97186d28354bebb8879a31a675764da456e272

SHA256
76eb04aa269163a918e09a82717d39f51bfd9934f4671f8b81eb7a71cf1b3ba4

SHA512
b0743b6a7e4f0a334ee753c26b383b521838700438da71ea6a2b4bb2e9019bac53a0982fc76e8eddff4c9a4e99a2f51f8653b12d602e5d91cee152bc6bfaf31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MPOTM.tmp-dbinst\setup.exe

Filesize
5.3MB

MD5
520e45d9974779f189291d0af776479e

SHA1
10ec615240bf36a431f3fa4039dc6f7a8c77d2b3

SHA256
961acf1c9c20b1f2d435adf4a0b6277a6d07c4925d6e56863197a401fd3756e1

SHA512
d73b2fdb9745223707ddcfc0aedcb43b124a1df394110e49a47a52b48ded1dfbfb3239c061af8f11ecd13432419d605a5a3be688f057373ede4e106630d8caba

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MPOTM.tmp\EULA.rtf

Filesize
28KB

MD5
b0381f0ba7ead83ea3bd882c1de4cd48

SHA1
c740f811623061595d76fce2ebb4e69d34316f3b

SHA256
44bc9472169403484a0d384f1ca81989ef7e4b07441758e8a0110078933cbcb5

SHA512
6cfb8bc562d22843d043411720db97d0b4cbac96a20983d83d19e59b8428ec202f2532cc5af254438dc34fca4161abbd3f6bac8d397590e41b6d41e60700e78a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SUFST.tmp\driver_booster_setup.tmp

Filesize
1.2MB

MD5
048f89f1be0ce17f10350b121c08b6bd

SHA1
d0746f79ab4c1c6712e787d30e7896cf02439d1a

SHA256
8dfc033ff5a1ebac9282f15f14ab048b73fb058fec927a1f5d188a359315c6eb

SHA512
f21b627324fb58f2a585c99df6309e11ae11f895e6f5b6f0d4f9b02368ec9982728e43a3aba5d346d3ca45419fc593293665305f067d9d9f41753d201a9ea90a

Download Submit
memory/3272-59-0x0000000000400000-0x0000000000996000-memory.dmp

Filesize
5.6MB

Download
memory/3272-103-0x0000000000400000-0x0000000000996000-memory.dmp

Filesize
5.6MB

Download
memory/3272-189-0x0000000000400000-0x0000000000996000-memory.dmp

Filesize
5.6MB

Download
memory/3876-58-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3876-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3876-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/4436-56-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/4436-6-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing