Analysis
-
max time kernel
42s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 04:58
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win10v2004-20241007-en
General
-
Target
Bootstrapper.exe
-
Size
800KB
-
MD5
02c70d9d6696950c198db93b7f6a835e
-
SHA1
30231a467a49cc37768eea0f55f4bea1cbfb48e2
-
SHA256
8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
-
SHA512
431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
-
SSDEEP
12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Bootstrapper.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation BootstrapperV2.04.exe -
Executes dropped EXE 2 IoCs
pid Process 1700 BootstrapperV2.04.exe 1460 Solara.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 36 pastebin.com 37 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 508 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4968 taskmgr.exe 4968 taskmgr.exe 1460 Solara.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1620 Bootstrapper.exe Token: SeDebugPrivilege 1700 BootstrapperV2.04.exe Token: SeDebugPrivilege 1460 Solara.exe Token: SeDebugPrivilege 4968 taskmgr.exe Token: SeSystemProfilePrivilege 4968 taskmgr.exe Token: SeCreateGlobalPrivilege 4968 taskmgr.exe Token: 33 4968 taskmgr.exe Token: SeIncBasePriorityPrivilege 4968 taskmgr.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1620 wrote to memory of 4496 1620 Bootstrapper.exe 83 PID 1620 wrote to memory of 4496 1620 Bootstrapper.exe 83 PID 4496 wrote to memory of 508 4496 cmd.exe 85 PID 4496 wrote to memory of 508 4496 cmd.exe 85 PID 1620 wrote to memory of 1700 1620 Bootstrapper.exe 87 PID 1620 wrote to memory of 1700 1620 Bootstrapper.exe 87 PID 1700 wrote to memory of 1460 1700 BootstrapperV2.04.exe 95 PID 1700 wrote to memory of 1460 1700 BootstrapperV2.04.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ipconfig /all2⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:508
-
-
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.04.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.04.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\ProgramData\Solara\Solara.exe"C:\ProgramData\Solara\Solara.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4968
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
695KB
MD5195ffb7167db3219b217c4fd439eedd6
SHA11e76e6099570ede620b76ed47cf8d03a936d49f8
SHA256e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
SHA51256eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
-
Filesize
133KB
MD5c6f770cbb24248537558c1f06f7ff855
SHA1fdc2aaae292c32a58ea4d9974a31ece26628fdd7
SHA256d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b
SHA512cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a
-
Filesize
5.2MB
MD5aead90ab96e2853f59be27c4ec1e4853
SHA143cdedde26488d3209e17efff9a51e1f944eb35f
SHA25646cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
SHA512f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
-
Filesize
2.8MB
MD5be4da425d9b7593e358ffbfca29f9c70
SHA1dc98530aad9728d779866ae957a738c52b13a565
SHA256c5277ddb6e51181d2b8bad59acf5f2badf5613b1e73384a84b793f720aa76c0d
SHA51235790944f5855038f8357c0f6d11ea81b260632e590c26f9342e8beb1a8dfd2e3eb9efa11f8378f8542cad45e7675af3d29cf27424accf35aaa6aeb34487155b