e8419d5bb0db3e945ca90579f079fdf907237defe8017c63e0188b2de518b1d3 | Triage

Sharing

General

Target

Terminator3.1.exe
Size

2.0MB
Sample

240428-rtq6ksab21
MD5

2bc248da7543ff3e8a7aeb2353d4daa7
SHA1

2ab295c16a8b762a26b37dc71c08dacda6bf8bbe
SHA256

e8419d5bb0db3e945ca90579f079fdf907237defe8017c63e0188b2de518b1d3
SHA512

3bb822b668506fac45d803b7ebe2b5d5bd2ca9d851746ceedb02619fc9c1f54648a720a7d9fde6e29bb7ac017fefb721c55b2de64f5eeada3e6f2d11f3fefbdf
SSDEEP

24576:qD/RbUThN+XbXgZruqHrawhaUTFR7mDdsrsG5UHulCXR+xaTSfoY4f0y3QzpCy8v:qjRbU2XlqHBNpEdsC5TSf

Score

9^/10

bootkit persistence ransomware spyware stealer upx

Malware Config

Targets

- Target
  
  Terminator3.1.exe
- Size
  
  2.0MB
- MD5
  
  2bc248da7543ff3e8a7aeb2353d4daa7
- SHA1
  
  2ab295c16a8b762a26b37dc71c08dacda6bf8bbe
- SHA256
  
  e8419d5bb0db3e945ca90579f079fdf907237defe8017c63e0188b2de518b1d3
- SHA512
  
  3bb822b668506fac45d803b7ebe2b5d5bd2ca9d851746ceedb02619fc9c1f54648a720a7d9fde6e29bb7ac017fefb721c55b2de64f5eeada3e6f2d11f3fefbdf
- SSDEEP
  
  24576:qD/RbUThN+XbXgZruqHrawhaUTFR7mDdsrsG5UHulCXR+xaTSfoY4f0y3QzpCy8v:qjRbU2XlqHBNpEdsC5TSf
Score

9^/10

bootkit persistence ransomware spyware stealer upx
- Renames multiple (234) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Drops startup file
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Privilege Escalation

Event Triggered Execution

Change Default File Association

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Defacement

Resource Development

Reconnaissance

Tasks

static1

behavioral1

bootkitpersistenceransomwarespywarestealerupx