9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2 | Triage

Submit
Reports

Overview

overview

8

Static

static

9eaede2721...b2.exe

windows7-x64

8

9eaede2721...b2.exe

windows10-2004-x64

8

Sharing

General

Target

9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2
Size

1.3MB
Sample

221123-xm664sfe39
MD5

0ebcb9350873fd1075e4953c7d628008
SHA1

ff610acbba1118fc945a67689fe52cfbe72090b4
SHA256

9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2
SHA512

b8ab30e850114d9e92616aaec1c1a36cbffab5c04d94ec04fb3b364f1f3e54b55c475ae0c2cc20647d35d9b91898e1cc97fb70be5b24f79ff33ed115f12bdde7
SSDEEP

24576:GZjO+TAqzACKyMyKiAgPcVgiTybPo1YuOZNWmO0u5cc9kYxubPaGNMy0yNSF183n:dR0P2CM15r5cc9xlGNMyZNSFsqja

Score

8^/10

bootkit discovery persistence upx

Static task

static1

Behavioral task

behavioral1

Sample

9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2.exe

Resource

win7-20221111-en

bootkit discovery persistence upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2.exe

Resource

win10v2004-20221111-en

bootkit discovery persistence upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2
- Size
  
  1.3MB
- MD5
  
  0ebcb9350873fd1075e4953c7d628008
- SHA1
  
  ff610acbba1118fc945a67689fe52cfbe72090b4
- SHA256
  
  9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2
- SHA512
  
  b8ab30e850114d9e92616aaec1c1a36cbffab5c04d94ec04fb3b364f1f3e54b55c475ae0c2cc20647d35d9b91898e1cc97fb70be5b24f79ff33ed115f12bdde7
- SSDEEP
  
  24576:GZjO+TAqzACKyMyKiAgPcVgiTybPo1YuOZNWmO0u5cc9kYxubPaGNMy0yNSF183n:dR0P2CM15r5cc9xlGNMyZNSFsqja
Score

8^/10

bootkit discovery persistence upx
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistenceupx

behavioral2

bootkitdiscoverypersistenceupx

© 2018-2024

Terms | Privacy