Overview

overview

8

Static

static

5

6814d9f8fb...14.exe

windows7-x64

8

6814d9f8fb...14.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6814d9f8fb80420b7f312cc2c4d6a3905c79ffd71ca47a9563fd44401736a214

  • Size

    6.5MB

  • Sample

    221123-l2gzzsgb9y

  • MD5

    8be14523a8862b1caa98e218acc94958

  • SHA1

    c8ef028db2c37b4bbc0b3659aa0708558d5f71f8

  • SHA256

    6814d9f8fb80420b7f312cc2c4d6a3905c79ffd71ca47a9563fd44401736a214

  • SHA512

    1f5195fb70d2c3c15b23b1b9d11c3423040dab9cfec27d539fa3f21e33bba9e0e99d4611e3281d3868b0f7099bee0f52c2c1e065ebd109b64753980455651dfa

  • SSDEEP

    196608:be7k1bSAfCaSAd9tKjwEHl4mRSAIwGuJPy+x+ACN3b:b7c3DUEjZlbwj+x+bb

Score
8/10
bootkitpersistence

Malware Config

Targets

    • Target

      6814d9f8fb80420b7f312cc2c4d6a3905c79ffd71ca47a9563fd44401736a214

    • Size

      6.5MB

    • MD5

      8be14523a8862b1caa98e218acc94958

    • SHA1

      c8ef028db2c37b4bbc0b3659aa0708558d5f71f8

    • SHA256

      6814d9f8fb80420b7f312cc2c4d6a3905c79ffd71ca47a9563fd44401736a214

    • SHA512

      1f5195fb70d2c3c15b23b1b9d11c3423040dab9cfec27d539fa3f21e33bba9e0e99d4611e3281d3868b0f7099bee0f52c2c1e065ebd109b64753980455651dfa

    • SSDEEP

      196608:be7k1bSAfCaSAd9tKjwEHl4mRSAIwGuJPy+x+ACN3b:b7c3DUEjZlbwj+x+bb

    Score
    8/10
    bootkitpersistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks