a2b36a892051d97df05882f6d457a5a5d202e3d1a6b18633c0daa22985e36c17 | Triage

Sharing

General

Target

a2b36a892051d97df05882f6d457a5a5d202e3d1a6b18633c0daa22985e36c17
Size

3.7MB
Sample

240128-mla26safdq
MD5

e9f8fff735ef15ea4488ae273b5a6ca1
SHA1

400ad4464f5900ea413020333e7edbb7faed0567
SHA256

a2b36a892051d97df05882f6d457a5a5d202e3d1a6b18633c0daa22985e36c17
SHA512

9745e45b68d719dc0c3a9c6f373bd411023eea2181d7ae5662af5ac64250fe92e93450b0a27b4a816f25419fdf07beadbc53d7bb1d291adaf9acaca9d8ad4028
SSDEEP

49152:jR7p2tKp8TxbXTtoA6dgvYtBL0H7n41FGYna6wTzAwsxqIaS3Dq2PEFTQ311iKUJ:d7pgFDpoPdggLL0Hns3aobLebQq5vv

Score

7^/10

bootkit persistence

Malware Config

Targets

- Target
  
  a2b36a892051d97df05882f6d457a5a5d202e3d1a6b18633c0daa22985e36c17
- Size
  
  3.7MB
- MD5
  
  e9f8fff735ef15ea4488ae273b5a6ca1
- SHA1
  
  400ad4464f5900ea413020333e7edbb7faed0567
- SHA256
  
  a2b36a892051d97df05882f6d457a5a5d202e3d1a6b18633c0daa22985e36c17
- SHA512
  
  9745e45b68d719dc0c3a9c6f373bd411023eea2181d7ae5662af5ac64250fe92e93450b0a27b4a816f25419fdf07beadbc53d7bb1d291adaf9acaca9d8ad4028
- SSDEEP
  
  49152:jR7p2tKp8TxbXTtoA6dgvYtBL0H7n41FGYna6wTzAwsxqIaS3Dq2PEFTQ311iKUJ:d7pgFDpoPdggLL0Hns3aobLebQq5vv
Score

7^/10

bootkit persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence