Overview

overview

10

Static

static

8bc9ade4ed...65.exe

windows7-x64

10

8bc9ade4ed...65.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8bc9ade4ed4d6ea38ba60ba4722c08e6c60051b87d6aad3fd8a78d24abc61d65

  • Size

    550KB

  • Sample

    221205-2x47qaeh45

  • MD5

    6c2bdbe4a05394bd07d3c5cb1ef3e4ce

  • SHA1

    b97023af779e32eb80f9374d638953b89398ab7a

  • SHA256

    8bc9ade4ed4d6ea38ba60ba4722c08e6c60051b87d6aad3fd8a78d24abc61d65

  • SHA512

    f828c3f1447d94d45e171b867c7f31d5a01c7696040b20b614c1f3aabe4bc02e1dab6917843d665250ddd56c6a3c4a34dc3f74755ecc9bfe2b9a0dec4099e8b0

  • SSDEEP

    12288:HTJYMTw0s/iIxz9XTzzwbIQ7w+TmejNpYtlovVgMbRV4Q:JOn+S+3YtlovGMFV4Q

Score
10/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      8bc9ade4ed4d6ea38ba60ba4722c08e6c60051b87d6aad3fd8a78d24abc61d65

    • Size

      550KB

    • MD5

      6c2bdbe4a05394bd07d3c5cb1ef3e4ce

    • SHA1

      b97023af779e32eb80f9374d638953b89398ab7a

    • SHA256

      8bc9ade4ed4d6ea38ba60ba4722c08e6c60051b87d6aad3fd8a78d24abc61d65

    • SHA512

      f828c3f1447d94d45e171b867c7f31d5a01c7696040b20b614c1f3aabe4bc02e1dab6917843d665250ddd56c6a3c4a34dc3f74755ecc9bfe2b9a0dec4099e8b0

    • SSDEEP

      12288:HTJYMTw0s/iIxz9XTzzwbIQ7w+TmejNpYtlovVgMbRV4Q:JOn+S+3YtlovGMFV4Q

    Score
    10/10
    bootkitevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks