11dc21dd222ee46678aa25b6b891791e3080863892ccd0d614948cdb5dfb1751

General

Target
oya.exe
Size 5.0MB
Sample261014-1apyvaswes
SHA256 11dc21dd222ee46678aa25b6b891791e3080863892ccd0d614948cdb5dfb1751
MD5 6ee0e12b1e6f37c470a3d194e0f73502
SHA1 c90fe1ec66d5eec5112f13d97201e5eaf624f7d5
SHA512 da37697e47862221f15c6094b1f75e6948445b2cb5e52f8d760bd82f6d216c19e446d66e4e1f775ea8302052c83b681e10fd1448328bd20fea9265000d9a8b8e
SSDEEP 98304:lcctEC3QyvUqyXyOLymDF1yc6JTREhPTMgRoLZLqq+S3EC1Qs:aGEC38dyOLymDvv67AUR5+S3ws
TLSH
T1E93633E9BB224F1AE11759B5C5E2D738F3D1980B8BED633CE225426B194B7613048F5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion execution persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oya.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	oya.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	oya.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1156	cmd.exe
4632	cmd.exe
3340	cmd.exe
5420	cmd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6032	oya.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6032 wrote to memory of 3340	6032	oya.exe	90
PID 6032 wrote to memory of 4536	6032	oya.exe	91
PID 6032 wrote to memory of 5420	6032	oya.exe	92
PID 6032 wrote to memory of 3264	6032	oya.exe	93
PID 6032 wrote to memory of 1156	6032	oya.exe	94
PID 6032 wrote to memory of 1232	6032	oya.exe	95
PID 6032 wrote to memory of 4632	6032	oya.exe	96

C:\Users\Admin\AppData\Local\Temp\oya.exe
"C:\Users\Admin\AppData\Local\Temp\oya.exe"
1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:6032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f gusto.exe
  2⤵
  PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f gustos.sys
  2⤵
  PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f drv64.dll
  2⤵
  PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

drv64.dll

Path C:\Users\Admin\AppData\Local\Temp\drv64.dll
Size 866KB
SHA256 914561f8d4919124fc13708a6736c254f449987df3ae020ffd4f7e7016ae808b
MD5 b2004a24d53e8e0f5e4f687eb86105df
SHA1 4b76fc8e605b38214958265c062cd96be0367894
SHA512 19a202b9d954f170de2f92a7c2bc9ef0a23ecd5cc65a7b2c50fb40c48f5239cf358788afb9a5018f8f5647a63a557745dcdf3b98bad65c0c246e957ddaf21e9e
SSDEEP 12288:7hE7/OAnfbSJrD6n/Im5hkK9W4Iyo4J4b4zD3PRNhhIaqcMuceZDHlBtkSpJo7wl:C7/NfaejRHIyZJdX3pNh+PcNRHtkI
TLSH
T14A15234C1B98B248F23B1A34C773ED52441AF9FE24A70F59F6BDC04F1C9A252950DAAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gusto.exe

Path C:\Users\Admin\AppData\Local\Temp\gusto.exe
Size 323KB
SHA256 0dcced90d194a977f068614e03011513414699c1719600bc11d176e5ad0e5b9f
MD5 c739f696ed73b16b0216b5ff45b26ae2
SHA1 30ef319164995a005112926c7e8145cfdd2a0280
SHA512 d40e29d9929dc856e4913737bc8e6d6ecefbd8cb5b69f04f93ef35a4c27864006c276c9cee97faae1e50145bad077d241e584291479d8e234e64dd30866377e2
SSDEEP 6144:yvCUTaZUsvKG8qb+5QYa2Af1ItYYpYea4afQo92fk2:yGZVvKG1y5q0
TLSH
T1F964391362DC3CE9D4768275AB7387C2D7BAFC550660C60F12E002569E7F2927E2ABD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gustos.sys

Path C:\Users\Admin\AppData\Local\Temp\gustos.sys
Size 12KB
SHA256 8418186545a549643c4b8bd4d377e1cd6975bf72bdcbef3572a50098f0770e67
MD5 ff1d4de5bebacb1622e447501f711a2c
SHA1 c288952fdfe4e2525acf49a5ed43909e790aa05d
SHA512 75090f4515a8399693c365837752e16fb1953836cd83fe4d2b98e966532fd44f0d137090a77b40223fb94db749c369876009a3006afe0a844e1704f1c88cd407
SSDEEP 192:06DI1mNSSdv6B7W2DJsSEc+PbwTJ0Bxs1AdGp79kp0XGDuCfd3:051mE5Jl6xBxs1UxWW9
TLSH
T139420AA1B3150AEBE1DA84BD90A75136EF75F70473124FCF0356C86907A2FE4A63A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6032-0-0x00007FF749FA0000-0x00007FF74ABF7000-memory.dmp

Download

memory/6032-11-0x00007FF749FA0000-0x00007FF74ABF7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads