0606454f187c37eb4caed5fd234031c5466849dcc37a08707ce2c94b366878d1 | Triage

Submit
Reports

Overview

overview

8

Static

static

0606454f18...d1.exe

windows7-x64

8

0606454f18...d1.exe

windows10-2004-x64

8

Sharing

General

Target

0606454f187c37eb4caed5fd234031c5466849dcc37a08707ce2c94b366878d1
Size

1.7MB
Sample

221124-cp4hsaba98
MD5

fdd172f932a6c370b293ddba5a94012a
SHA1

dad544044b1832d9ed499b40a4b08e6f9b993d11
SHA256

0606454f187c37eb4caed5fd234031c5466849dcc37a08707ce2c94b366878d1
SHA512

f8405e9428ec0fdce37c61dc208947a3a28e8953b3f1eae6e20deb95d7e38d3e7e5aba715cd0d378fb6613e356c00fcb82ed50a82253e9d83cbdec3fabe24977
SSDEEP

49152:YlmSaFP8BVDk1jbGhXm0psRX1y3CAlsM3:YluPKkjihXm0IXQyAB3

Score

8^/10

bootkit evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

0606454f187c37eb4caed5fd234031c5466849dcc37a08707ce2c94b366878d1.exe

Resource

win7-20220812-en

bootkit evasion persistence trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

0606454f187c37eb4caed5fd234031c5466849dcc37a08707ce2c94b366878d1.exe

Resource

win10v2004-20221111-en

bootkit persistence

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  0606454f187c37eb4caed5fd234031c5466849dcc37a08707ce2c94b366878d1
- Size
  
  1.7MB
- MD5
  
  fdd172f932a6c370b293ddba5a94012a
- SHA1
  
  dad544044b1832d9ed499b40a4b08e6f9b993d11
- SHA256
  
  0606454f187c37eb4caed5fd234031c5466849dcc37a08707ce2c94b366878d1
- SHA512
  
  f8405e9428ec0fdce37c61dc208947a3a28e8953b3f1eae6e20deb95d7e38d3e7e5aba715cd0d378fb6613e356c00fcb82ed50a82253e9d83cbdec3fabe24977
- SSDEEP
  
  49152:YlmSaFP8BVDk1jbGhXm0psRX1y3CAlsM3:YluPKkjihXm0IXQyAB3
Score

8^/10

bootkit evasion persistence trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitevasionpersistencetrojan

behavioral2

bootkitpersistence

© 2018-2024

Terms | Privacy