| File name: | Bootstrapper.exe |
| Full analysis: | https://app.any.run/tasks/719ca2a7-6f5d-4c33-b120-7bf311555970 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | August 26, 2024, 16:53:30 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | E6319BB0DC280E27D9B7FFD6E495FD16 |
| SHA1: | 16EFDB8546CB63176938D29EC833196B8BEE7DDA |
| SHA256: | 929A14100972F4B530F80C035D4A1B9641F0E6C3A8E8A54B5C4956174DF5696C |
| SSDEEP: | 24576:MPPGGkRAxiXhNa1SVYGD5aaLV8AOEuMXbcZadmciIap4MDsOA6e:MPPGGkRAxiXXa1SVYm5aaLV8AOEuMXbh |
MALICIOUS
Changes the login/logoff helper path in the registry
- Boоtstrapper.exe (PID: 3812)
Changes the AppInit_DLLs value (autorun option)
- Boоtstrapper.exe (PID: 3812)
Changes the autorun value in the registry
- Boоtstrapper.exe (PID: 3812)
XORed URL has been found (YARA)
- Boоtstrapper.exe (PID: 3812)
Connects to the CnC server
- Boоtstrapper.exe (PID: 3812)
SHEETRAT has been detected (SURICATA)
- Boоtstrapper.exe (PID: 3812)
SUSPICIOUS
Drops the executable file immediately after the start
- Boоtstrapper.exe (PID: 3812)
The process creates files with name similar to system file names
- Boоtstrapper.exe (PID: 3812)
Starts CMD.EXE for commands execution
- Boоtstrapper.exe (PID: 3812)
The process checks if it is being run in the virtual environment
- Boоtstrapper.exe (PID: 3812)
Connects to unusual port
- Boоtstrapper.exe (PID: 3812)
Contacting a server suspected of hosting an CnC
- Boоtstrapper.exe (PID: 3812)
INFO
Reads the computer name
- Boоtstrapper.exe (PID: 3812)
Checks supported languages
- Boоtstrapper.exe (PID: 3812)
Creates files or folders in the user directory
- Boоtstrapper.exe (PID: 3812)
Reads the machine GUID from the registry
- Boоtstrapper.exe (PID: 3812)
Reads the time zone
- Boоtstrapper.exe (PID: 3812)
Reads CPU info
- Boоtstrapper.exe (PID: 3812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
xor-url
(PID) Processunknown
Decrypted-URLs (1)http://marketdedamoroza.webhop.me/index.html
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:08:26 16:47:06+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 11 |
| CodeSize: | 570880 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x8d46e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| FileDescription: | |
| FileVersion: | 1.0.0.0 |
| InternalName: | Bootstrapper.exe |
| LegalCopyright: | |
| OriginalFileName: | Bootstrapper.exe |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
245
Monitored processes
2
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2256 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3812 | "C:\Users\admin\AppData\Local\Temp\Boоtstrapper.exe" | C:\Users\admin\AppData\Local\Temp\Boоtstrapper.exe | Boоtstrapper.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Client Version: 1.0.0.0 Modules
| |||||||||||||||
Total events
5 035
Read events
5 019
Write events
16
Delete events
0
Modification events
| (PID) Process: | (3812) Boоtstrapper.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows |
| Operation: | write | Name: | AppInit_DLLs |
Value: C:\WINDOWS\xdwd.dll | |||
| (PID) Process: | (3812) Boоtstrapper.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows |
| Operation: | write | Name: | LoadAppInit_DLLs |
Value: 1 | |||
| (PID) Process: | (3812) Boоtstrapper.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows |
| Operation: | write | Name: | RequireSignedAppInit_DLLs |
Value: 0 | |||
| (PID) Process: | (3812) Boоtstrapper.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon |
| Operation: | write | Name: | Userinit |
Value: C:\Windows\System32\userinit.exe,C:\Users\admin\AppData\Roaming\Sub\svchost.exe | |||
| (PID) Process: | (3812) Boоtstrapper.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | svchost |
Value: C:\Users\admin\AppData\Roaming\Sub\svchst.exe | |||
| (PID) Process: | (3812) Boоtstrapper.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage |
| Operation: | write | Name: | Export |
Value: .NET Memory Cache 4.0 | |||
| (PID) Process: | (3812) Boоtstrapper.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage |
| Operation: | write | Name: | Export |
Value: MSDTC Bridge 3.0.0.0 | |||
| (PID) Process: | (3812) Boоtstrapper.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage |
| Operation: | write | Name: | Export |
Value: MSDTC Bridge 4.0.0.0 | |||
| (PID) Process: | (3812) Boоtstrapper.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage |
| Operation: | write | Name: | Export |
Value: ServiceModelEndpoint 3.0.0.0 | |||
| (PID) Process: | (3812) Boоtstrapper.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage |
| Operation: | write | Name: | Export |
Value: ServiceModelOperation 3.0.0.0 | |||
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3812 | Boоtstrapper.exe | C:\Windows\xdwd.dll | executable | |
MD5:16E5A492C9C6AE34C59683BE9C51FA31 | SHA256:35C8D022E1D917F1AABDCEAE98097CCC072161B302F84C768CA63E4B32AC2B66 | |||
| 3812 | Boоtstrapper.exe | C:\Users\admin\AppData\Roaming\Sub\svchost.exe | executable | |
MD5:D5C80CD4D273242EEDE7B371B85CC52C | SHA256:5BD1C89909E4087836F230221AA0B0AB368A1CF811650F3972468CA6115227C7 | |||
| 3812 | Boоtstrapper.exe | C:\Users\admin\AppData\Roaming\Sub\svchst.exe | executable | |
MD5:D5C80CD4D273242EEDE7B371B85CC52C | SHA256:5BD1C89909E4087836F230221AA0B0AB368A1CF811650F3972468CA6115227C7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
17
DNS requests
10
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
236 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
236 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5644 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
5612 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 239.255.255.250:1900 | — | — | — | whitelisted |
5644 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3260 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
236 | SIHClient.exe | 52.165.165.26:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
236 | SIHClient.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
236 | SIHClient.exe | 20.242.39.171:443 | fe3cr.delivery.mp.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
especially-religions.gl.at.ply.gg |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2256 | svchost.exe | Potentially Bad Traffic | ET INFO playit .gg Tunneling Domain in DNS Lookup |
2256 | svchost.exe | Misc activity | ET INFO Tunneling Service in DNS Lookup (* .ply .gg) |
3812 | Boоtstrapper.exe | Malware Command and Control Activity Detected | REMOTE [ANY.RUN] SheetRat (Ping) |
1 ETPRO signatures available at the full report