Overview

overview

7

Static

static

3

937175c6da...c2.exe

windows7-x64

7

937175c6da...c2.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    02-09-2023 02:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    937175c6da6d4a351aab64841705e34df4a3c8e710cfbd5af9908cc57c813ec2.exe

  • Size

    13.2MB

  • MD5

    63ed4aa822ae95efd9eece1f200845b3

  • SHA1

    ac428e19bcd148342fabbdb99530ecc93b37f782

  • SHA256

    937175c6da6d4a351aab64841705e34df4a3c8e710cfbd5af9908cc57c813ec2

  • SHA512

    e5e6c889ab970285900931cf61f08389d00278e1da35acfe0203d8ba7c3bc9597f6e9dc2ee50a15428343fe6bd5c01c85b4b794c02464305e557fb5db22add26

  • SSDEEP

    393216:K94UdVEy9qMBNLtloGoGiplhpKdMNgYJYw7tqK8QeA:84UdVEy9qMBNDoGoxplhQd6tYw7SA

Score
7/10
bootkitpersistence

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\937175c6da6d4a351aab64841705e34df4a3c8e710cfbd5af9908cc57c813ec2.exe
    "C:\Users\Admin\AppData\Local\Temp\937175c6da6d4a351aab64841705e34df4a3c8e710cfbd5af9908cc57c813ec2.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    PID:2052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\{0E70115C-1552-4c57-BBE0-78FDDEF0C812}.tmp\Utils\7z.dll
    Filesize

    1.1MB

    MD5

    5c3382df7349dc2b42a2aae9a595779e

    SHA1

    2ab5a4369b6938a89008eccec8fa7595a6eda5e8

    SHA256

    ca1e6b74d9448aa1b2daf7b843a4cc80a6fed13fe9480e0296ac8cadbae80d7e

    SHA512

    5b9824552262e34bd50748529f3b8a053ef0faeda51a85735daa3521eeb28bbc1148de5e1508d7da3a6c8c8d4a31a355876872c46ed22250be1eb202bfcf1907

    Download Submit

  • C:\ProgramData\{0E70115C-1552-4c57-BBE0-78FDDEF0C812}.tmp\netul.dll
    Filesize

    1.9MB

    MD5

    b434b1eff14158cb7708d70478b4f89a

    SHA1

    3e1411c5d7a5cffcf3c0b998cc7ea0b187c90ffb

    SHA256

    e62f24419a4e9a511f95183a276b6eb27a685c64f37b9f2449ab993d33e9d708

    SHA512

    303809947f45576cee4690fc90a85840d805bc42da2a0737f9f64d58b4ad5b170c5b3cbc89e3d12b1d7d0d554f87d22bb33644a64ad587d201d7fb47d43b0b75

    Download Submit

  • \Users\Admin\AppData\Local\Temp\netul.dll
    Filesize

    1.9MB

    MD5

    b434b1eff14158cb7708d70478b4f89a

    SHA1

    3e1411c5d7a5cffcf3c0b998cc7ea0b187c90ffb

    SHA256

    e62f24419a4e9a511f95183a276b6eb27a685c64f37b9f2449ab993d33e9d708

    SHA512

    303809947f45576cee4690fc90a85840d805bc42da2a0737f9f64d58b4ad5b170c5b3cbc89e3d12b1d7d0d554f87d22bb33644a64ad587d201d7fb47d43b0b75

    Download Submit

  • \Users\Admin\AppData\Local\Temp\{78744E1F-F2EC-4d01-986D-72118C3B5CF7}.tmp\7z.dll
    Filesize

    1.1MB

    MD5

    5c3382df7349dc2b42a2aae9a595779e

    SHA1

    2ab5a4369b6938a89008eccec8fa7595a6eda5e8

    SHA256

    ca1e6b74d9448aa1b2daf7b843a4cc80a6fed13fe9480e0296ac8cadbae80d7e

    SHA512

    5b9824552262e34bd50748529f3b8a053ef0faeda51a85735daa3521eeb28bbc1148de5e1508d7da3a6c8c8d4a31a355876872c46ed22250be1eb202bfcf1907

    Download Submit

  • memory/2052-30-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

    Download