f6e18db3eddc0bdea065565e8553eb7d204c9ceb3523f71f87c92dc9142e3796 | Triage

Sharing

General

Target

f6e18db3eddc0bdea065565e8553eb7d204c9ceb3523f71f87c92dc9142e3796
Size

4.4MB
Sample

221125-kz93baae5t
MD5

29e56f2193f23eebca5f6c931d93d4d4
SHA1

5fff1405963cebedea5d404319d2dea998d1c8b9
SHA256

f6e18db3eddc0bdea065565e8553eb7d204c9ceb3523f71f87c92dc9142e3796
SHA512

dd4496bd89387e32777ab38cf52ac9505258473911f408a1af0fe570e8fc2116f3c622374298a478c3c42ac3fc7c12dd6821fe6c6fc0db1baec74fc1e1b2b523
SSDEEP

98304:fBHB2pne7a1mN1E8lkcf5YjovKqGYiOE8oLj5jIrHLy:fv1GGE5gyjovK65E8oqjLy

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  f6e18db3eddc0bdea065565e8553eb7d204c9ceb3523f71f87c92dc9142e3796
- Size
  
  4.4MB
- MD5
  
  29e56f2193f23eebca5f6c931d93d4d4
- SHA1
  
  5fff1405963cebedea5d404319d2dea998d1c8b9
- SHA256
  
  f6e18db3eddc0bdea065565e8553eb7d204c9ceb3523f71f87c92dc9142e3796
- SHA512
  
  dd4496bd89387e32777ab38cf52ac9505258473911f408a1af0fe570e8fc2116f3c622374298a478c3c42ac3fc7c12dd6821fe6c6fc0db1baec74fc1e1b2b523
- SSDEEP
  
  98304:fBHB2pne7a1mN1E8lkcf5YjovKqGYiOE8oLj5jIrHLy:fv1GGE5gyjovK65E8oqjLy
Score

8^/10

bootkit persistence
- Blocklisted process makes network request
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2