fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301

General

Target
fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Size 6.8MB
Sample260706-pynvxaft51
SHA256 fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301
MD5 60301c7088142d3cd72b3a36f5cee918
SHA1 03cde0f945ad5f87080224f01dd56485e074a136
SHA512 6c9b1d9d2f17ad9aae51f0d1e0b327a35c5949286474249dbcb02c6227357c5f0577cfac449ddb1791a52c2b8fbf489d914475b6bfa95436a44648658fe72881
SSDEEP 196608:Eo9pwI0xAEF4UFhlUM8P8wceYdObywORMs0Wwb:FyIvEeUFhlUMFFjObybMsy
TLSH
T11466F112BE80C432E5A201729A7D7F694AFDFA311729C5C3ABD9099D4D309D2B739327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "6d95419fd616496018c10222ea37cf08"	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "wrf9pb8gl48qkmhwvwrt9ugl5k5j"	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\mid = "140148175"	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\mid = "140148175"	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{9B4EEDF7-FC98-4fa0-8440-9D1BC57B5F2F}\desc = "eyJkYXRlIjoiMjAyNi0wNy0wNiJ9"	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{9B4EEDF7-FC98-4fa0-8440-9D1BC57B5F2F}\user_type = "0"	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{9B4EEDF7-FC98-4fa0-8440-9D1BC57B5F2F}\uid = "722a3138d35798296a4ba33c0005b216"	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "wrf9pb8gl48qkmhwvwrt9ugl5k5j"	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{9B4EEDF7-FC98-4fa0-8440-9D1BC57B5F2F}\time = "1783341882"	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0"	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "654b161d139cf66b35fbd60ba4448b2a"	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{9B4EEDF7-FC98-4fa0-8440-9D1BC57B5F2F}	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6136	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
6136	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
6136	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
6136	fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe

C:\Users\Admin\AppData\Local\Temp\fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe
"C:\Users\Admin\AppData\Local\Temp\fcb8dfb3f67805067bf87b3bcd63c0dcc92ddf7a795c41d1e8d6ab2ffb838301.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hg.dat

Path C:\ProgramData\Kingsoft\KIS\hg.dat
Size 53B
SHA256 7712f5c18155ca14aadbb5a9ee1c6a5c5bfa3f80daa72f61b44ce676a57dd28d
MD5 04abd74f1145417733f024b574f99641
SHA1 3b2fd784b45c281b39d3d526a7dde65690e48237
SHA512 f3dfd22249c8b370f573a51621d6c0fb80b934cd0c21d80ec549dbf73261c24acd842fdf96b776b9202fac7758f30d0ea0e52173709ad505d4d78a0ed3587df0
TLSH
T14E90027D650C44974574B21151166DEC25944845576007E846494761081A508490AE8D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6136-0-0x0000000000330000-0x000000000078C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads