Overview

overview

8

Static

static

7a37f9b76c...09.exe

windows7-x64

8

7a37f9b76c...09.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109

  • Size

    639KB

  • Sample

    221203-gmfq6adh2t

  • MD5

    b7cd08ef1e02cb4c47dd84d7eefded14

  • SHA1

    72c61924af666b93187d5bfa639c794ee111b8c9

  • SHA256

    7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109

  • SHA512

    6b17c3236ac69b9191f133996fc5a24252161b2a657f139adef28f70c4743a4b1da44b9105c1f4a58ef4fd77ea56939db8313afb051bb35a7d6146b8e8ac0da6

  • SSDEEP

    12288:OgitGs0IsFqner8qaMoGUFOcMxTY0gTurlOGb5O+yHCs57bBQe5A:LitV0IsFKer8RMoRF6qTurlDVO7H/57S

Score
8/10
bootkitevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109

    • Size

      639KB

    • MD5

      b7cd08ef1e02cb4c47dd84d7eefded14

    • SHA1

      72c61924af666b93187d5bfa639c794ee111b8c9

    • SHA256

      7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109

    • SHA512

      6b17c3236ac69b9191f133996fc5a24252161b2a657f139adef28f70c4743a4b1da44b9105c1f4a58ef4fd77ea56939db8313afb051bb35a7d6146b8e8ac0da6

    • SSDEEP

      12288:OgitGs0IsFqner8qaMoGUFOcMxTY0gTurlOGb5O+yHCs57bBQe5A:LitV0IsFKer8RMoRF6qTurlDVO7H/57S

    Score
    8/10
    spywarestealerbootkitevasionpersistencetrojan

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks