36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e

General

Target

36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
Size

1.5MB
MD5

a790e22c9f0a53719daee116f0da2b60
SHA1

ced86c613a7c5f171788ca38eafb9085f2643229
SHA256

36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e
SHA512

834929d198ab0613cfb786e13e0f307032f13bdc47131e9358efc4c0bbc8ffc10aa2a12efd539d0f6336b4b6e21534811a3747be4f04df6abea09c1df613b7be

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 20 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe

description	ioc	process
File opened (read-only)	\??\G:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\P:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\Q:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\R:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\W:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\X:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\F:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\H:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\J:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\K:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\N:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\T:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\E:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\M:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\O:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\U:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\I:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\L:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\S:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
File opened (read-only)	\??\V:	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe

C:\Users\Admin\AppData\Local\Temp\36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe
"C:\Users\Admin\AppData\Local\Temp\36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:4060