4c3d06e3b774b10a3ce1561502a5fdb3938d9635651bcdcc7b42bab52dd15ed7

Analysis

max time kernel
123s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/09/2023, 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c3d06e3b774b10a3ce1561502a5fdb3938d9635651bcdcc7b42bab52dd15ed7.exe
Size

13.8MB
MD5

cf5945968800df9492081eece0260325
SHA1

2d94699534f5016f87984715f70cc21a021fd99f
SHA256

4c3d06e3b774b10a3ce1561502a5fdb3938d9635651bcdcc7b42bab52dd15ed7
SHA512

5322347bc10eae3f41fcbb88f8125bbcfa644e5b812615dfdbcc714134c1ac8ce0c09e3e0ab37a14bc7e5e8a67ee2309b8ba870687cd711e342430517056ff1a
SSDEEP

393216:d94UdVEy9qMBNLtloGociplhpuAAaZxShcTSuDSu:L4UdVEy9qMBNDoGoDplhAA9GyTEu

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1672	4c3d06e3b774b10a3ce1561502a5fdb3938d9635651bcdcc7b42bab52dd15ed7.exe
1672	4c3d06e3b774b10a3ce1561502a5fdb3938d9635651bcdcc7b42bab52dd15ed7.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	4c3d06e3b774b10a3ce1561502a5fdb3938d9635651bcdcc7b42bab52dd15ed7.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Loaf\{121CA584-7F1B-483c-8F8F-C945674BE537}.tf	4c3d06e3b774b10a3ce1561502a5fdb3938d9635651bcdcc7b42bab52dd15ed7.exe

C:\Users\Admin\AppData\Local\Temp\4c3d06e3b774b10a3ce1561502a5fdb3938d9635651bcdcc7b42bab52dd15ed7.exe
"C:\Users\Admin\AppData\Local\Temp\4c3d06e3b774b10a3ce1561502a5fdb3938d9635651bcdcc7b42bab52dd15ed7.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\{8F91BFA9-8C14-4927-845C-53628028E23D}.tmp\Utils\7z.dll

Filesize
1.1MB

MD5
5c3382df7349dc2b42a2aae9a595779e

SHA1
2ab5a4369b6938a89008eccec8fa7595a6eda5e8

SHA256
ca1e6b74d9448aa1b2daf7b843a4cc80a6fed13fe9480e0296ac8cadbae80d7e

SHA512
5b9824552262e34bd50748529f3b8a053ef0faeda51a85735daa3521eeb28bbc1148de5e1508d7da3a6c8c8d4a31a355876872c46ed22250be1eb202bfcf1907

Download Submit
C:\ProgramData\{8F91BFA9-8C14-4927-845C-53628028E23D}.tmp\netul.dll

Filesize
1.9MB

MD5
b434b1eff14158cb7708d70478b4f89a

SHA1
3e1411c5d7a5cffcf3c0b998cc7ea0b187c90ffb

SHA256
e62f24419a4e9a511f95183a276b6eb27a685c64f37b9f2449ab993d33e9d708

SHA512
303809947f45576cee4690fc90a85840d805bc42da2a0737f9f64d58b4ad5b170c5b3cbc89e3d12b1d7d0d554f87d22bb33644a64ad587d201d7fb47d43b0b75

Download Submit
\Users\Admin\AppData\Local\Temp\netul.dll

Filesize
1.9MB

MD5
b434b1eff14158cb7708d70478b4f89a

SHA1
3e1411c5d7a5cffcf3c0b998cc7ea0b187c90ffb

SHA256
e62f24419a4e9a511f95183a276b6eb27a685c64f37b9f2449ab993d33e9d708

SHA512
303809947f45576cee4690fc90a85840d805bc42da2a0737f9f64d58b4ad5b170c5b3cbc89e3d12b1d7d0d554f87d22bb33644a64ad587d201d7fb47d43b0b75

Download Submit
\Users\Admin\AppData\Local\Temp\{DA32A5BB-4AED-4e9b-B984-162B787F1320}.tmp\7z.dll

Filesize
1.1MB

MD5
5c3382df7349dc2b42a2aae9a595779e

SHA1
2ab5a4369b6938a89008eccec8fa7595a6eda5e8

SHA256
ca1e6b74d9448aa1b2daf7b843a4cc80a6fed13fe9480e0296ac8cadbae80d7e

SHA512
5b9824552262e34bd50748529f3b8a053ef0faeda51a85735daa3521eeb28bbc1148de5e1508d7da3a6c8c8d4a31a355876872c46ed22250be1eb202bfcf1907

Download Submit
memory/1672-29-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/1672-102-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads