d077b7042998e4ae2f816fa247c4bd2b9d59b53345f3250f6dbe1820d51e0c71

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24-10-2023 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d077b7042998e4ae2f816fa247c4bd2b9d59b53345f3250f6dbe1820d51e0c71.exe
Size

4.4MB
MD5

49a8698ec1aa24bb30d8426d4489f824
SHA1

5c02efa4d235b8491622fabb5d140e5db8c6458b
SHA256

d077b7042998e4ae2f816fa247c4bd2b9d59b53345f3250f6dbe1820d51e0c71
SHA512

37dcae7a7764969ace6ac00a8646aa794efb724a73dd6581b29966d8b9a8be53aa448a80e4224285721d5e857a9dceda955ef1a0613c926b2bacdbbd36128cb5
SSDEEP

49152:vuonNtbAAOHcfSgyXkuSMPirh6n0kAOHcfSgyXkuSMPirh6Y2:mcNtbmgylSMqrhTCgylSMqrhP2

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2376	d077b7042998e4ae2f816fa247c4bd2b9d59b53345f3250f6dbe1820d51e0c71.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	d077b7042998e4ae2f816fa247c4bd2b9d59b53345f3250f6dbe1820d51e0c71.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2376	d077b7042998e4ae2f816fa247c4bd2b9d59b53345f3250f6dbe1820d51e0c71.exe
2376	d077b7042998e4ae2f816fa247c4bd2b9d59b53345f3250f6dbe1820d51e0c71.exe

C:\Users\Admin\AppData\Local\Temp\d077b7042998e4ae2f816fa247c4bd2b9d59b53345f3250f6dbe1820d51e0c71.exe
"C:\Users\Admin\AppData\Local\Temp\d077b7042998e4ae2f816fa247c4bd2b9d59b53345f3250f6dbe1820d51e0c71.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230819.lib

Filesize
1.6MB

MD5
a1df3b7884c175c967505a589ba51da2

SHA1
7aaf570e41a00149134973d00f4efc09c4b650c2

SHA256
c16014329cf6f242a525f6782dd10f6a4d0ff6f97239710fdc45522f5c6da525

SHA512
12b8bd05fd9bec79d643edb503634b8b5238c67c77ddd8d2c3220406c08b1e6197e8aff02c709e353bc4ce9353a6709837b81ca443660250d94e73c00d66f451

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads