Overview

overview

7

Static

static

3

6cfa43ff0e...30.exe

windows7-x64

7

6cfa43ff0e...30.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2023 13:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6cfa43ff0e537606d86718d9d618da11422deed60bd6bea0ad63dd1eab1eed30.exe

  • Size

    15.0MB

  • MD5

    1673ef97e54c3af54983aec906835e81

  • SHA1

    0b4ef70a94a07c75ab2e6ac080f12f8f18dbade3

  • SHA256

    6cfa43ff0e537606d86718d9d618da11422deed60bd6bea0ad63dd1eab1eed30

  • SHA512

    1510ac2f79e7300a736477a79052ede1203f83ca008cb10205e63b667ee2570f5631b34944d51021322305e7fe6724ecb737999239843423c70e7bdb59ca08d8

  • SSDEEP

    393216:a4UdVEy9qMBNLtZaL+xbxlSqKoe8kfiEiSoPqbVRlcdfYkf:a4UdVEy9qMBN7aLQYWEToP6c1f

Score
7/10
bootkitpersistence

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6cfa43ff0e537606d86718d9d618da11422deed60bd6bea0ad63dd1eab1eed30.exe
    "C:\Users\Admin\AppData\Local\Temp\6cfa43ff0e537606d86718d9d618da11422deed60bd6bea0ad63dd1eab1eed30.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    PID:2080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\netul.dll
    Filesize

    1.9MB

    MD5

    6355fc65038e58c1ee13077955ac9e47

    SHA1

    bf5996a2f36b312443340efc14c454fe7845c689

    SHA256

    387db30cc4af3363def8374729cf79fc680f82a25ddc65186ee2941d13aa368c

    SHA512

    c83f4e81a10fc0615f245a0de9b8081430284995cbe0f134fb44258511e0b5409a7e72a10f47ab000ed98d41545b03bc68845bc6f81e8b0fd6d9cc89d2b4f124

    Download Submit

  • \Users\Admin\AppData\Local\Temp\{26CCD070-1040-4360-BBAF-6FE13244B982}.tmp\7z.dll
    Filesize

    1.1MB

    MD5

    da0654ae63ff2b4ba16a255356d07af3

    SHA1

    c5d1988e3676d4c97c672c450be841612793e57f

    SHA256

    7d37421cf4c371251225fe8aa5efdab0ddff6775cc4ecb8b4cc494777d1ea607

    SHA512

    970636caee5427bab7914f32a7cfa45076cce5369e505f97e3fd57cd1c1d6ef167dc0234ddb03fc27a917f575c4d56ef416e377bd05727b61e6efa2ceaca794c

    Download Submit

  • memory/2080-31-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2080-92-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

    Download