Overview

overview

8

Static

static

1

ddc164d783...c8.exe

windows7-x64

8

ddc164d783...c8.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    ddc164d78308225c2d47e2cdf31670a8cffbce08cd4761fd08c55836139179c8

  • Size

    944KB

  • Sample

    221011-ha44naaedr

  • MD5

    6c250c4d04b4118384c6f62d93c4c60c

  • SHA1

    8df4126c0f8ec09bbf20536d720044e72390101a

  • SHA256

    ddc164d78308225c2d47e2cdf31670a8cffbce08cd4761fd08c55836139179c8

  • SHA512

    e4b36c4aea5ea0de3faf8ed8ccce378ca2142bc1eda7313dc9c583bb4c9fa50c80e3bb0be54c227c375e70b8c12ac0971a0451530488b186f120f760df0db96d

  • SSDEEP

    24576:0v7/AjVp3iQtShip5+UKtmy4/14IRsSVyjdVYHFss:0v7/AjVpNA4p5+UK4y4b9idVYH3

Score
8/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      ddc164d78308225c2d47e2cdf31670a8cffbce08cd4761fd08c55836139179c8

    • Size

      944KB

    • MD5

      6c250c4d04b4118384c6f62d93c4c60c

    • SHA1

      8df4126c0f8ec09bbf20536d720044e72390101a

    • SHA256

      ddc164d78308225c2d47e2cdf31670a8cffbce08cd4761fd08c55836139179c8

    • SHA512

      e4b36c4aea5ea0de3faf8ed8ccce378ca2142bc1eda7313dc9c583bb4c9fa50c80e3bb0be54c227c375e70b8c12ac0971a0451530488b186f120f760df0db96d

    • SSDEEP

      24576:0v7/AjVp3iQtShip5+UKtmy4/14IRsSVyjdVYHFss:0v7/AjVpNA4p5+UK4y4b9idVYH3

    Score
    8/10
    bootkitdiscoverypersistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks