Overview

overview

9

Static

static

934fbd8698...a0.exe

windows7-x64

9

934fbd8698...a0.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    934fbd86989687f52c545ecfb3f77b788dab7ff488173dce80a79d94372b13a0

  • Size

    4.8MB

  • Sample

    221203-w6v3hshg6v

  • MD5

    e2daecc66f0181622d700ac3aadcea4e

  • SHA1

    5264be367bba2bfb3dd6aa74a1859e3b295545b6

  • SHA256

    934fbd86989687f52c545ecfb3f77b788dab7ff488173dce80a79d94372b13a0

  • SHA512

    8bc55d375919cf7f1651537604b3e37d295a85c0096d60b5604905dab03b6c676880a53b98680c4f1ff4dcc1ce104b20ad994fd7c23cbb74177c956a026965dc

  • SSDEEP

    98304:wayOm/cuoYVHEaGwAzrDCa9U4VlwPd2Zasn01NkG6HWBirpbCErL2Hkr:wOm/ZoYh0zrvU4Vlw12K3QFpCErL4

Score
9/10
bootkitevasionpersistenceupx

Malware Config

Targets

    • Target

      934fbd86989687f52c545ecfb3f77b788dab7ff488173dce80a79d94372b13a0

    • Size

      4.8MB

    • MD5

      e2daecc66f0181622d700ac3aadcea4e

    • SHA1

      5264be367bba2bfb3dd6aa74a1859e3b295545b6

    • SHA256

      934fbd86989687f52c545ecfb3f77b788dab7ff488173dce80a79d94372b13a0

    • SHA512

      8bc55d375919cf7f1651537604b3e37d295a85c0096d60b5604905dab03b6c676880a53b98680c4f1ff4dcc1ce104b20ad994fd7c23cbb74177c956a026965dc

    • SSDEEP

      98304:wayOm/cuoYVHEaGwAzrDCa9U4VlwPd2Zasn01NkG6HWBirpbCErL2Hkr:wOm/ZoYh0zrvU4Vlw12K3QFpCErL4

    Score
    9/10
    bootkitevasionpersistenceupx

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks