Overview
overview
8Static
static
8DSDOS.bat
windows7_x64
1DSDOS.bat
windows10-2004_x64
1DSDOS.exe
windows7_x64
DSDOS.exe
windows10-2004_x64
DSWIN.bat
windows7_x64
6DSWIN.bat
windows10-2004_x64
6DSWIN.exe
windows7_x64
6DSWIN.exe
windows10-2004_x64
6MANUAL.pdf
windows7_x64
1MANUAL.pdf
windows10-2004_x64
1SETUP.exe
windows7_x64
6SETUP.exe
windows10-2004_x64
7Analysis
-
max time kernel
91s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 04:52
Static task
static1
Behavioral task
behavioral1
Sample
DSDOS.bat
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DSDOS.bat
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
DSDOS.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
DSDOS.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
DSWIN.bat
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
DSWIN.bat
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
DSWIN.exe
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
DSWIN.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
MANUAL.pdf
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
MANUAL.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
SETUP.exe
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
SETUP.exe
Resource
win10v2004-20220414-en
General
-
Target
DSWIN.exe
-
Size
1.5MB
-
MD5
a790e22c9f0a53719daee116f0da2b60
-
SHA1
ced86c613a7c5f171788ca38eafb9085f2643229
-
SHA256
36b65013b08b08b1dcf2aa2c73ccba772bdf33a809e91d4642c89955ac4b9f0e
-
SHA512
834929d198ab0613cfb786e13e0f307032f13bdc47131e9358efc4c0bbc8ffc10aa2a12efd539d0f6336b4b6e21534811a3747be4f04df6abea09c1df613b7be
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
DSWIN.exedescription ioc process File opened (read-only) \??\P: DSWIN.exe File opened (read-only) \??\Q: DSWIN.exe File opened (read-only) \??\R: DSWIN.exe File opened (read-only) \??\U: DSWIN.exe File opened (read-only) \??\E: DSWIN.exe File opened (read-only) \??\J: DSWIN.exe File opened (read-only) \??\M: DSWIN.exe File opened (read-only) \??\O: DSWIN.exe File opened (read-only) \??\N: DSWIN.exe File opened (read-only) \??\V: DSWIN.exe File opened (read-only) \??\W: DSWIN.exe File opened (read-only) \??\F: DSWIN.exe File opened (read-only) \??\H: DSWIN.exe File opened (read-only) \??\X: DSWIN.exe File opened (read-only) \??\S: DSWIN.exe File opened (read-only) \??\T: DSWIN.exe File opened (read-only) \??\G: DSWIN.exe File opened (read-only) \??\I: DSWIN.exe File opened (read-only) \??\K: DSWIN.exe File opened (read-only) \??\L: DSWIN.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
DSWIN.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 DSWIN.exe