3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe
Size

6.0MB
MD5

7304ef0fed52080a4cee1e43c5b2152a
SHA1

1688a964421a310b4114efcd96bc68d2e1476a8c
SHA256

3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5
SHA512

798af86b66565f7961c35472bd1f8d5fba66b85efa43d45739e1f94dc3ffe397e2c90047709c21bc4e3d701b41641dd3a36bbdcec7a9775d0ea6ebf7d90a2c7f
SSDEEP

98304:FowD5bUqJPIP5Mi/HbMpGbMTFVfFlYzCiPkGtsQfvFxpm2XIKeaeopuDizw98ZbH:FoSbiP5MAHbMUi90eSZH/eopuDBj8

Score

7^/10

bootkit persistence upx vmprotect

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe

pid process

2272 3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2272-53-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2272-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2272-35-0x0000000000400000-0x0000000001362000-memory.dmp	vmprotect
behavioral1/memory/2272-86-0x0000000000400000-0x0000000001362000-memory.dmp	vmprotect
behavioral1/memory/2272-87-0x0000000000400000-0x0000000001362000-memory.dmp	vmprotect
behavioral1/memory/2272-88-0x0000000000400000-0x0000000001362000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe

description ioc process

File opened for modification \??\PhysicalDrive0 3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe

pid process

2272 3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe

pid process

2272 3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe
2272 3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe

pid	process
2272	3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe
2272	3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe
2272	3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe

C:\Users\Admin\AppData\Local\Temp\3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe
"C:\Users\Admin\AppData\Local\Temp\3b7662feb1f7f52cd445b7305f95a08141c5dccd0e3e6d7c098a991b1751f9e5.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2272

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\E2EECore.2.3.0.dll
Filesize
8.2MB

MD5
b36c5ac6ebe053d9c9e638b688723f46

SHA1
63c51f04293e26a8a49fa04c5e0b342ffae5381f

SHA256
860394ea3a52757ce1a875e5a598c3c30752a673150df37b7c0e599f224f5877

SHA512
933f428911ed0e56fa201f124ab85f5383cf9ae3465516c8eaf4d2d63788ffd3812df67f3fd75a1304b26e4bcebc6bd84fa08563dd5b9c4727f86bf96a0d5a09

Download Submit
memory/2272-35-0x0000000000400000-0x0000000001362000-memory.dmp

Filesize
15.4MB

Download
memory/2272-27-0x00000000013B0000-0x00000000013B1000-memory.dmp

Filesize
4KB

Download
memory/2272-36-0x0000000000928000-0x0000000000D5B000-memory.dmp

Filesize
4.2MB

Download
memory/2272-29-0x00000000013B0000-0x00000000013B1000-memory.dmp

Filesize
4KB

Download
memory/2272-24-0x00000000013A0000-0x00000000013A1000-memory.dmp

Filesize
4KB

Download
memory/2272-22-0x00000000013A0000-0x00000000013A1000-memory.dmp

Filesize
4KB

Download
memory/2272-19-0x0000000001390000-0x0000000001391000-memory.dmp

Filesize
4KB

Download
memory/2272-17-0x0000000001390000-0x0000000001391000-memory.dmp

Filesize
4KB

Download
memory/2272-14-0x0000000001380000-0x0000000001381000-memory.dmp

Filesize
4KB

Download
memory/2272-12-0x0000000001380000-0x0000000001381000-memory.dmp

Filesize
4KB

Download
memory/2272-9-0x0000000001370000-0x0000000001371000-memory.dmp

Filesize
4KB

Download
memory/2272-7-0x0000000001370000-0x0000000001371000-memory.dmp

Filesize
4KB

Download
memory/2272-5-0x0000000001370000-0x0000000001371000-memory.dmp

Filesize
4KB

Download
memory/2272-4-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2272-2-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2272-0-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2272-30-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/2272-34-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/2272-32-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/2272-53-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-86-0x0000000000400000-0x0000000001362000-memory.dmp

Filesize
15.4MB

Download
memory/2272-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-51-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2272-87-0x0000000000400000-0x0000000001362000-memory.dmp

Filesize
15.4MB

Download
memory/2272-88-0x0000000000400000-0x0000000001362000-memory.dmp

Filesize
15.4MB

Download