de44201d7dab72507b2f94a753ebe3f1148ef62b95742f4da32a5b273d89e074 | Triage

Sharing

General

Target

de44201d7dab72507b2f94a753ebe3f1148ef62b95742f4da32a5b273d89e074
Size

841KB
Sample

221203-xc25eaeg55
MD5

af5fa50b86feb6b2b21fb291a7e04a4f
SHA1

a2c632df5c8946012bd9c35ba9f95f8c3fc6381f
SHA256

de44201d7dab72507b2f94a753ebe3f1148ef62b95742f4da32a5b273d89e074
SHA512

fc974d14a54db05cd8466f5c30627242fd75ed77f2b343c0bfa7d0f3bdae4a319f23d8a0484c12ea53f30440afb24c16db536f3e0cee5850afcf70d3d3a8abab
SSDEEP

24576:681dAtsOGdZowWGrpTsRY3KrfuM1kI5YfI12Or:5AtsnbDWxq/ukI5euHr

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  de44201d7dab72507b2f94a753ebe3f1148ef62b95742f4da32a5b273d89e074
- Size
  
  841KB
- MD5
  
  af5fa50b86feb6b2b21fb291a7e04a4f
- SHA1
  
  a2c632df5c8946012bd9c35ba9f95f8c3fc6381f
- SHA256
  
  de44201d7dab72507b2f94a753ebe3f1148ef62b95742f4da32a5b273d89e074
- SHA512
  
  fc974d14a54db05cd8466f5c30627242fd75ed77f2b343c0bfa7d0f3bdae4a319f23d8a0484c12ea53f30440afb24c16db536f3e0cee5850afcf70d3d3a8abab
- SSDEEP
  
  24576:681dAtsOGdZowWGrpTsRY3KrfuM1kI5YfI12Or:5AtsnbDWxq/ukI5euHr
Score

8^/10

bootkit persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence