Overview

overview

9

Static

static

8

a9b6da9873...9c.exe

windows7-x64

9

a9b6da9873...9c.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a9b6da98731e3e9ffd32cfbf6dc1a13d82e88bcaa747595dab154a74de39289c

  • Size

    2.2MB

  • Sample

    221206-c226gshb54

  • MD5

    9e4d09a7474c46b0a3ff4cfa5008bc37

  • SHA1

    9f20082009c22993c537d6853415c52e4996130b

  • SHA256

    a9b6da98731e3e9ffd32cfbf6dc1a13d82e88bcaa747595dab154a74de39289c

  • SHA512

    3acbeba466ceee2f18db9a77ef024172691cea1740b5d119ad5f895e73bcef790fc0d8cdec263f021991f3be3100dc42cddd95b6ac942210407fda2686b34de5

  • SSDEEP

    49152:N0WOSXVYV0JGKWZBFzCqFPu5rzt876hCwS/vdjj:0/R5FkrFEvFj

Score
9/10
bootkitpersistenceupxvmprotect

Malware Config

Targets

    • Target

      a9b6da98731e3e9ffd32cfbf6dc1a13d82e88bcaa747595dab154a74de39289c

    • Size

      2.2MB

    • MD5

      9e4d09a7474c46b0a3ff4cfa5008bc37

    • SHA1

      9f20082009c22993c537d6853415c52e4996130b

    • SHA256

      a9b6da98731e3e9ffd32cfbf6dc1a13d82e88bcaa747595dab154a74de39289c

    • SHA512

      3acbeba466ceee2f18db9a77ef024172691cea1740b5d119ad5f895e73bcef790fc0d8cdec263f021991f3be3100dc42cddd95b6ac942210407fda2686b34de5

    • SSDEEP

      49152:N0WOSXVYV0JGKWZBFzCqFPu5rzt876hCwS/vdjj:0/R5FkrFEvFj

    Score
    9/10
    bootkitpersistenceupxvmprotect

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks