Overview

overview

7

Static

static

3

b14f359745...79.exe

windows7-x64

7

b14f359745...79.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    22/11/2023, 08:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b14f3597459b121dd8c5ba0cb561ef1f507012c656bce355963053023303c279.exe

  • Size

    5.3MB

  • MD5

    0f4f602bea755044616cef60b8cad504

  • SHA1

    17bca6f1e8fe8b115262acc3cbfcbffe2fb112f4

  • SHA256

    b14f3597459b121dd8c5ba0cb561ef1f507012c656bce355963053023303c279

  • SHA512

    09b1a1e5aa78dbd67ff5d89324c8df873c5831bbeb6bd1158c3c146f5e86ff755451f63d08a7c07dd0ac9acbcf23e4aceee8a53b964fd00795f52ad9d52d3ffa

  • SSDEEP

    98304:P+qCzZ9GSvkf+Gp9PGMhRiCu/CVUdVEy9qMBNP/qxct8qdvZOMA4bj:MzZ9tGe4UdVEy9qMBNLtNvZOMA4

Score
7/10
bootkitpersistence

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b14f3597459b121dd8c5ba0cb561ef1f507012c656bce355963053023303c279.exe
    "C:\Users\Admin\AppData\Local\Temp\b14f3597459b121dd8c5ba0cb561ef1f507012c656bce355963053023303c279.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 912
      2⤵
      • Program crash
      PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\netul.dll
    Filesize

    1.9MB

    MD5

    b434b1eff14158cb7708d70478b4f89a

    SHA1

    3e1411c5d7a5cffcf3c0b998cc7ea0b187c90ffb

    SHA256

    e62f24419a4e9a511f95183a276b6eb27a685c64f37b9f2449ab993d33e9d708

    SHA512

    303809947f45576cee4690fc90a85840d805bc42da2a0737f9f64d58b4ad5b170c5b3cbc89e3d12b1d7d0d554f87d22bb33644a64ad587d201d7fb47d43b0b75

    Download Submit

  • \Users\Admin\AppData\Local\Temp\{052BF631-C4A7-4bd1-A58D-28289C42B822}.tmp\7z.dll
    Filesize

    1.1MB

    MD5

    f0fef6362d4886e85a186a5e3766650a

    SHA1

    65843b7052a4d1b84762479d79445c46834e18b5

    SHA256

    15b9fe7d408cbf2204039087526e7df947df57b42ea479e303b682e956638816

    SHA512

    3f6dfd701cf62b77219f8825a2257c4bd7d44ebafc5654b06abaf906ced2571f4eeb04fe22ae6136c14bddebddb12555aa6efd322e779443d57bb122ea786043

    Download Submit

  • memory/2024-17-0x00000000005A0000-0x00000000005A1000-memory.dmp

    Filesize

    4KB

    Download