Overview

overview

7

Static

static

7

9db6e32b70...57.exe

windows7-x64

7

9db6e32b70...57.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9db6e32b706235b07706d22f35eaa4cdb92c3c66acccc7f9b89f65ef819eb657

  • Size

    1.5MB

  • Sample

    230319-eqrlqagh2v

  • MD5

    e1bd4fb175ce3cc7fcf71c3fb23af564

  • SHA1

    503f2207e2932b968c95e407358d2ac0233006e1

  • SHA256

    9db6e32b706235b07706d22f35eaa4cdb92c3c66acccc7f9b89f65ef819eb657

  • SHA512

    0e1e4f20a8f27b0216d4216e661cdf7671c2a161a3c9bcdf4d0e8a4c9e59c858ee72b372c363e0e12f4a75dd6082a9337790da0edbf3d2f1b635d6754b1b048f

  • SSDEEP

    24576:EiNAsL1KSIBjSCp26JLJd9uWMnArfLzI36hdYGdvubM2leJgInedj495KVY8Dup3:EOA+peSa2uLJFMnArfLxhdYQvuFlWXnK

Score
7/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      9db6e32b706235b07706d22f35eaa4cdb92c3c66acccc7f9b89f65ef819eb657

    • Size

      1.5MB

    • MD5

      e1bd4fb175ce3cc7fcf71c3fb23af564

    • SHA1

      503f2207e2932b968c95e407358d2ac0233006e1

    • SHA256

      9db6e32b706235b07706d22f35eaa4cdb92c3c66acccc7f9b89f65ef819eb657

    • SHA512

      0e1e4f20a8f27b0216d4216e661cdf7671c2a161a3c9bcdf4d0e8a4c9e59c858ee72b372c363e0e12f4a75dd6082a9337790da0edbf3d2f1b635d6754b1b048f

    • SSDEEP

      24576:EiNAsL1KSIBjSCp26JLJd9uWMnArfLzI36hdYGdvubM2leJgInedj495KVY8Dup3:EOA+peSa2uLJFMnArfLxhdYQvuFlWXnK

    Score
    7/10
    bootkitpersistenceupx

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks