Overview

overview

8

Static

static

bb2240102e...27.exe

windows7-x64

8

bb2240102e...27.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb2240102e8e6a98b1b08b71b4a9337787215abecf62fe6ec2907a24c5880e27

  • Size

    2.3MB

  • Sample

    221203-g5mmesfb6y

  • MD5

    9a6ac3b7f27badcd42ac16f1274276f8

  • SHA1

    44ab62a0e3b49ec1f3f5b24ee19670f2ca4290fb

  • SHA256

    bb2240102e8e6a98b1b08b71b4a9337787215abecf62fe6ec2907a24c5880e27

  • SHA512

    2748a17fcf784ef4cdbafec4c3eceb17ac311416dac021209e3cc5ca197b97e2c81d29df4f46741d95e1077ad4682f90b79836d461448e3fe56a9d073358f73e

  • SSDEEP

    49152:a2AiqKkIfRPn3mCdKUGF6Tvxprvv0wcydl/fw1wxo/JEAG0:a2ATBIfRf3mCdKbFgx1v0HyT/kXZG0

Score
8/10
bootkitevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      bb2240102e8e6a98b1b08b71b4a9337787215abecf62fe6ec2907a24c5880e27

    • Size

      2.3MB

    • MD5

      9a6ac3b7f27badcd42ac16f1274276f8

    • SHA1

      44ab62a0e3b49ec1f3f5b24ee19670f2ca4290fb

    • SHA256

      bb2240102e8e6a98b1b08b71b4a9337787215abecf62fe6ec2907a24c5880e27

    • SHA512

      2748a17fcf784ef4cdbafec4c3eceb17ac311416dac021209e3cc5ca197b97e2c81d29df4f46741d95e1077ad4682f90b79836d461448e3fe56a9d073358f73e

    • SSDEEP

      49152:a2AiqKkIfRPn3mCdKUGF6Tvxprvv0wcydl/fw1wxo/JEAG0:a2ATBIfRf3mCdKbFgx1v0HyT/kXZG0

    Score
    8/10
    bootkitevasionpersistencespywarestealertrojan

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks