Overview

overview

10

Static

static

3

028d539c8a...b8.exe

windows7-x64

7

028d539c8a...b8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    028d539c8a88baaf6c5617771bc955b8.exe

  • Size

    456KB

  • Sample

    231230-vp2cjaahbn

  • MD5

    028d539c8a88baaf6c5617771bc955b8

  • SHA1

    910d5e4904ff794c129d23fb91661b45617ec2d9

  • SHA256

    e0bbe32adda0195b579f3a9837f4ddefebe313cdafef7b8e8d7b5b456b085963

  • SHA512

    92492479ba80efb22fae224d264bbd906568dc1b565efc8410ba9ec321eff324c9da9753272ffeadc2f35c53dff96d2af78f1672589b013bd43b5fcdfa792f31

  • SSDEEP

    12288:jEVXKpmok7if4JgTIoq43H2cE05nMx11DGkfb7i:jEtRDiAJgMe3H2cJCx1YOb7i

Score
10/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      028d539c8a88baaf6c5617771bc955b8.exe

    • Size

      456KB

    • MD5

      028d539c8a88baaf6c5617771bc955b8

    • SHA1

      910d5e4904ff794c129d23fb91661b45617ec2d9

    • SHA256

      e0bbe32adda0195b579f3a9837f4ddefebe313cdafef7b8e8d7b5b456b085963

    • SHA512

      92492479ba80efb22fae224d264bbd906568dc1b565efc8410ba9ec321eff324c9da9753272ffeadc2f35c53dff96d2af78f1672589b013bd43b5fcdfa792f31

    • SSDEEP

      12288:jEVXKpmok7if4JgTIoq43H2cE05nMx11DGkfb7i:jEtRDiAJgMe3H2cJCx1YOb7i

    Score
    10/10
    bootkitevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks