Overview

overview

8

Static

static

ca6de5ed40...f4.exe

windows7_x64

8

ca6de5ed40...f4.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4

  • Size

    904KB

  • Sample

    220520-ndn5hadgfn

  • MD5

    174dd7939ab780f7cf8118f9a8967afe

  • SHA1

    4fb8476faa85c3ba287c170ebd749331488be2f1

  • SHA256

    ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4

  • SHA512

    918b267890e2befea1abc78643338acd9edbf0c40bc3edcba293278425c41cf3f80eaa4c507bf7802b3c69afa64e9e411842bf9848877a235d2b70fb3e1f4958

Score
8/10
bootkitpersistence

Malware Config

Targets

    • Target

      ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4

    • Size

      904KB

    • MD5

      174dd7939ab780f7cf8118f9a8967afe

    • SHA1

      4fb8476faa85c3ba287c170ebd749331488be2f1

    • SHA256

      ca6de5ed4051ec20b8612d30b3962397fa0b6e209a2d223cef37708150e48df4

    • SHA512

      918b267890e2befea1abc78643338acd9edbf0c40bc3edcba293278425c41cf3f80eaa4c507bf7802b3c69afa64e9e411842bf9848877a235d2b70fb3e1f4958

    Score
    8/10
    bootkitpersistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Bootkit

1
T1067

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks