General

  • Target

    Bombermania.exe.zip

  • Size

    2.6MB

  • Sample

    230325-mmyvmaed8y

  • MD5

    e5459c4864695fda631fb328b024ce61

  • SHA1

    14c17c4446f03dcae11ca4ba4ebf81a0f35028d1

  • SHA256

    46ee42fb79a161bf3763e8e34a047018bd16d8572f8d31c2cdecae3d2e7a57a8

  • SHA512

    dd42df768a6d71ff56a4cd176427e5ba5169525db25bd69214206aae6f0e6b8c04b3451522c6ede5b197a1ae7264becbbfd077d961f309b9bba9969c0ea50986

  • SSDEEP

    49152:MrT6tmScfov2NB2orgfSvt4q/CRPdbLZ1k5iIdLu/k4mCwgFPWEe+YdS:M/6Fnv2NBzMOtqlvZ1FqDgFPZe+AS

Malware Config

Targets

    • Target

      Bombermania.exe

    • Size

      2.7MB

    • MD5

      471d39a51a79f342033c5b0636c244dc

    • SHA1

      b0324ddd99677d9b0458c7328879f8fde268effc

    • SHA256

      1154535130d546eaa33bbc9051a9cb91e2b0e3a3991286c3d5b0a708110c9aa7

    • SHA512

      e1df6f0c06a0438d7b1cabae01d38e9bb723feeff67b4a9c8176d46b4da7fbd89be287ff86db9617c02a553d1a7c76c7f5ad1286d12023ad7628f5b0a30066af

    • SSDEEP

      49152:F0Mnrnb04mvy6e4LzKCGilG4mvEsWI9ep0dZfyFhVWHRal0v:KMnn04mY6yilGd19cyhxq0v

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Bootkit

1
T1067

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks