26483abc7f3b2f5c33d9795587ea16ec8c3b28d3cffa4e314ab2be54f6d0a425

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2023, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

26483abc7f3b2f5c33d9795587ea16ec8c3b28d3cffa4e314ab2be54f6d0a425.exe
Size

5.2MB
MD5

d09887d744bff7777d2c845ec6e1e577
SHA1

bd3e064617b3e288cd6b95d3744a651f6e42409c
SHA256

26483abc7f3b2f5c33d9795587ea16ec8c3b28d3cffa4e314ab2be54f6d0a425
SHA512

48d0cfb7624a3c573f5f1d3a4f0001bacf8306d984fca641e5d749c25876931456b071c2303256b2a4d2cb91a777df6d0e30cdbf798e936945437fd7beed0590
SSDEEP

98304:QVHruMlntzn0k8YPG8hRiCu/CVUdVEy9qMBNP/qxct8qoZOMA44fj:UumnI4UdVEy9qMBNLt4ZOMA44

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
232	26483abc7f3b2f5c33d9795587ea16ec8c3b28d3cffa4e314ab2be54f6d0a425.exe
232	26483abc7f3b2f5c33d9795587ea16ec8c3b28d3cffa4e314ab2be54f6d0a425.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	26483abc7f3b2f5c33d9795587ea16ec8c3b28d3cffa4e314ab2be54f6d0a425.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	232	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\26483abc7f3b2f5c33d9795587ea16ec8c3b28d3cffa4e314ab2be54f6d0a425.exe
"C:\Users\Admin\AppData\Local\Temp\26483abc7f3b2f5c33d9795587ea16ec8c3b28d3cffa4e314ab2be54f6d0a425.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 1464
  2⤵
  - Program crash
  PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 232 -ip 232
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\netul.dll

Filesize
1.9MB

MD5
b434b1eff14158cb7708d70478b4f89a

SHA1
3e1411c5d7a5cffcf3c0b998cc7ea0b187c90ffb

SHA256
e62f24419a4e9a511f95183a276b6eb27a685c64f37b9f2449ab993d33e9d708

SHA512
303809947f45576cee4690fc90a85840d805bc42da2a0737f9f64d58b4ad5b170c5b3cbc89e3d12b1d7d0d554f87d22bb33644a64ad587d201d7fb47d43b0b75

Download Submit
C:\Users\Admin\AppData\Local\Temp\netul.dll

Filesize
1.9MB

MD5
b434b1eff14158cb7708d70478b4f89a

SHA1
3e1411c5d7a5cffcf3c0b998cc7ea0b187c90ffb

SHA256
e62f24419a4e9a511f95183a276b6eb27a685c64f37b9f2449ab993d33e9d708

SHA512
303809947f45576cee4690fc90a85840d805bc42da2a0737f9f64d58b4ad5b170c5b3cbc89e3d12b1d7d0d554f87d22bb33644a64ad587d201d7fb47d43b0b75

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A2854216-1F3F-48ed-882D-F2C9B0CF0ABC}.tmp\7z.dll

Filesize
1.1MB

MD5
f0fef6362d4886e85a186a5e3766650a

SHA1
65843b7052a4d1b84762479d79445c46834e18b5

SHA256
15b9fe7d408cbf2204039087526e7df947df57b42ea479e303b682e956638816

SHA512
3f6dfd701cf62b77219f8825a2257c4bd7d44ebafc5654b06abaf906ced2571f4eeb04fe22ae6136c14bddebddb12555aa6efd322e779443d57bb122ea786043

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A2854216-1F3F-48ed-882D-F2C9B0CF0ABC}.tmp\7z.dll

Filesize
1.1MB

MD5
f0fef6362d4886e85a186a5e3766650a

SHA1
65843b7052a4d1b84762479d79445c46834e18b5

SHA256
15b9fe7d408cbf2204039087526e7df947df57b42ea479e303b682e956638816

SHA512
3f6dfd701cf62b77219f8825a2257c4bd7d44ebafc5654b06abaf906ced2571f4eeb04fe22ae6136c14bddebddb12555aa6efd322e779443d57bb122ea786043

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads