Overview

overview

8

Static

static

8dede52db3...3c.exe

windows7-x64

1

8dede52db3...3c.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c

  • Size

    27KB

  • Sample

    221203-g6an9abh48

  • MD5

    8a14b82fdbf63695569b3aaa1b76dca3

  • SHA1

    81ea5808fe48d81746b3d28b449fbf87507897f1

  • SHA256

    8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c

  • SHA512

    3d6cd80116e56d1a8a70b4177ca8a6daf89897e2fd54e1bfbf3a5b899011d2404f99d52707758ab3044215f57e78a1fd6709efc4e67ada46aa8a24d113a2ec04

  • SSDEEP

    768:DBu6LUjA/P4t6yeNR78L1yShobJDDLQppv:duAAhcuLWbBLQL

Score
8/10
bootkitpersistence

Malware Config

Targets

    • Target

      8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c

    • Size

      27KB

    • MD5

      8a14b82fdbf63695569b3aaa1b76dca3

    • SHA1

      81ea5808fe48d81746b3d28b449fbf87507897f1

    • SHA256

      8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c

    • SHA512

      3d6cd80116e56d1a8a70b4177ca8a6daf89897e2fd54e1bfbf3a5b899011d2404f99d52707758ab3044215f57e78a1fd6709efc4e67ada46aa8a24d113a2ec04

    • SSDEEP

      768:DBu6LUjA/P4t6yeNR78L1yShobJDDLQppv:duAAhcuLWbBLQL

    Score
    8/10
    bootkitpersistence

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks