Overview

overview

8

Static

static

ea42e0e4cb...7b.exe

windows7-x64

8

ea42e0e4cb...7b.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea42e0e4cb0f2fce99e5fab1307039c1425b60f33479325c3f3dc0ac71d8e77b

  • Size

    986KB

  • Sample

    221203-gxnvhsbb99

  • MD5

    7fbfa0d896f1297f6ac4a2c30faa1e13

  • SHA1

    b20f28b73f9c2f34d9e2611b659ecc8730bf9d87

  • SHA256

    ea42e0e4cb0f2fce99e5fab1307039c1425b60f33479325c3f3dc0ac71d8e77b

  • SHA512

    22ecc9910e66d5a7c6575b921e5f9510a655c34f58b6fa1dc79ef6da2c2ff0a956ec01c11b3ad3966fb19e857510b5fcbcff1daa71cbafe2aa2a3f9bd912f7de

  • SSDEEP

    24576:Lt/Z9arRbSnCS/ZmExYaEsAGSTU9twGTdK8kUu1hLMlV:NCFbSCSIEiLsA+92udK8bKYV

Score
8/10
bootkitevasionpersistencetrojan

Malware Config

Targets

    • Target

      ea42e0e4cb0f2fce99e5fab1307039c1425b60f33479325c3f3dc0ac71d8e77b

    • Size

      986KB

    • MD5

      7fbfa0d896f1297f6ac4a2c30faa1e13

    • SHA1

      b20f28b73f9c2f34d9e2611b659ecc8730bf9d87

    • SHA256

      ea42e0e4cb0f2fce99e5fab1307039c1425b60f33479325c3f3dc0ac71d8e77b

    • SHA512

      22ecc9910e66d5a7c6575b921e5f9510a655c34f58b6fa1dc79ef6da2c2ff0a956ec01c11b3ad3966fb19e857510b5fcbcff1daa71cbafe2aa2a3f9bd912f7de

    • SSDEEP

      24576:Lt/Z9arRbSnCS/ZmExYaEsAGSTU9twGTdK8kUu1hLMlV:NCFbSCSIEiLsA+92udK8bKYV

    Score
    8/10
    bootkitevasionpersistencetrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks