Analysis
-
max time kernel
40s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 07:42
Static task
static1
Behavioral task
behavioral1
Sample
e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exe
Resource
win10v2004-20220414-en
General
-
Target
e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exe
-
Size
956KB
-
MD5
7ee33bc8844bfffa8b67707fe43e28d5
-
SHA1
d26454279d716475900b8f50d1bd46ec7e6971cc
-
SHA256
e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb
-
SHA512
2ad11b1c268c51431ee9bfdf41addfcaf6b1aa3693eb51ba295d824382b4ab74c5fc806045d5ee96ee01ddd1694934523ca20c5ec42e802be11711c7d2c0ee53
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/776-55-0x0000000010000000-0x000000001000B000-memory.dmp upx behavioral1/memory/776-56-0x0000000010000000-0x000000001000B000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exedescription ioc process File opened for modification \??\PhysicalDrive0 e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exe