General

  • Target

    549f05d9c10be5e43c6b2eb0a370b048ccf98a0a1f05f02280b541f20aa7304e

  • Size

    31.5MB

  • Sample

    221128-sfa3wacb65

  • MD5

    825c74709ea3d2f5f19ba58f4d995cba

  • SHA1

    d43f1c0983f212ea808fa73b2921b5c0fb0ac42a

  • SHA256

    549f05d9c10be5e43c6b2eb0a370b048ccf98a0a1f05f02280b541f20aa7304e

  • SHA512

    ffa696d104047ff9243b1aa4179f8c3762615e33cb7eadf5e9b439e5263dda458227a0a12437810383a80961f745f78e64b4985aa67c65ef7fcd82cde447c063

  • SSDEEP

    786432:haXj+hzDp2e6W3dJzZji9iRKpL+f3WmB3f0AUKX:haz+jvX3bzZjUL+Pr3fhD

Malware Config

Targets

    • Target

      549f05d9c10be5e43c6b2eb0a370b048ccf98a0a1f05f02280b541f20aa7304e

    • Size

      31.5MB

    • MD5

      825c74709ea3d2f5f19ba58f4d995cba

    • SHA1

      d43f1c0983f212ea808fa73b2921b5c0fb0ac42a

    • SHA256

      549f05d9c10be5e43c6b2eb0a370b048ccf98a0a1f05f02280b541f20aa7304e

    • SHA512

      ffa696d104047ff9243b1aa4179f8c3762615e33cb7eadf5e9b439e5263dda458227a0a12437810383a80961f745f78e64b4985aa67c65ef7fcd82cde447c063

    • SSDEEP

      786432:haXj+hzDp2e6W3dJzZji9iRKpL+f3WmB3f0AUKX:haz+jvX3bzZjUL+Pr3fhD

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Registers COM server for autorun

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

3
T1060

Bootkit

1
T1067

Defense Evasion

Modify Registry

4
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks