Analysis
-
max time kernel
0s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 11:34
Behavioral task
behavioral1
Sample
1b2891404f1d1a6d5d588b8c49e4abae.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1b2891404f1d1a6d5d588b8c49e4abae.exe
Resource
win10v2004-20231215-en
General
-
Target
1b2891404f1d1a6d5d588b8c49e4abae.exe
-
Size
329KB
-
MD5
1b2891404f1d1a6d5d588b8c49e4abae
-
SHA1
a2a08f6848f9a2af3b11148bf7c0e9cc0fbfdea5
-
SHA256
5be7b8e138347efe330d65944bd018e0f379096dc5601235eafc6b402ed5953a
-
SHA512
232fd9cc133616a478b12c856fc3065312f3fed4a96ff456011da3267dae4d854ee4409842231966882e712decac6c5ac5c3a088997912808b1cc00e115cbd6e
-
SSDEEP
6144:ES+QH6yN8wfRe3q+2ZYbO2PY/eQanlrUnwyzqE4t1eKY4A66w8vUwybq0:uE6y66e3N272PYXZnbmm5ldvUwyb
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4496-0-0x0000000000400000-0x00000000004BC000-memory.dmp upx -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\j: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\z: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\g: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\k: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\p: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\q: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\r: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\s: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\e: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\i: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\u: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\w: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\x: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\y: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\l: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\m: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\n: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\o: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\t: 1b2891404f1d1a6d5d588b8c49e4abae.exe File opened (read-only) \??\v: 1b2891404f1d1a6d5d588b8c49e4abae.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 1b2891404f1d1a6d5d588b8c49e4abae.exe