b538d5a54eeceb832bd5d3024623e87ee89e3d133bafb6f8ca95a9bc9f1d82f2

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b538d5a54eeceb832bd5d3024623e87ee89e3d133bafb6f8ca95a9bc9f1d82f2.exe
Size

2.4MB
MD5

fa4656c63807d13fa3bb35f686652ff0
SHA1

79ae3b4498f913dbaadff498fd552b4011339e2a
SHA256

b538d5a54eeceb832bd5d3024623e87ee89e3d133bafb6f8ca95a9bc9f1d82f2
SHA512

04521e2f18d98d418e0ff01200eaa2c84067c6ad976c8beb60150a8f4fcbe4a430e23844fbd58be74f4d18369c5ff355de737a74248fdfd4b081b5b89f901c8c
SSDEEP

24576:vFnGkINu8auhjmfv2di/GulD1PAoXGj3K6I4i6zGRMx0H9I7+R7+RENPHdO8ub/3:FrfWje2diRAOHcfSgyXkuSMPirh67S

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1100	b538d5a54eeceb832bd5d3024623e87ee89e3d133bafb6f8ca95a9bc9f1d82f2.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b538d5a54eeceb832bd5d3024623e87ee89e3d133bafb6f8ca95a9bc9f1d82f2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1100	b538d5a54eeceb832bd5d3024623e87ee89e3d133bafb6f8ca95a9bc9f1d82f2.exe
1100	b538d5a54eeceb832bd5d3024623e87ee89e3d133bafb6f8ca95a9bc9f1d82f2.exe

C:\Users\Admin\AppData\Local\Temp\b538d5a54eeceb832bd5d3024623e87ee89e3d133bafb6f8ca95a9bc9f1d82f2.exe
"C:\Users\Admin\AppData\Local\Temp\b538d5a54eeceb832bd5d3024623e87ee89e3d133bafb6f8ca95a9bc9f1d82f2.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230819.lib

Filesize
1.6MB

MD5
a1df3b7884c175c967505a589ba51da2

SHA1
7aaf570e41a00149134973d00f4efc09c4b650c2

SHA256
c16014329cf6f242a525f6782dd10f6a4d0ff6f97239710fdc45522f5c6da525

SHA512
12b8bd05fd9bec79d643edb503634b8b5238c67c77ddd8d2c3220406c08b1e6197e8aff02c709e353bc4ce9353a6709837b81ca443660250d94e73c00d66f451

Download Submit
memory/1100-0-0x0000000000400000-0x0000000000672000-memory.dmp

Filesize
2.4MB

Download
memory/1100-5-0x0000000000400000-0x0000000000672000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads