Analysis

  • max time kernel
    126s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 10:38

General

  • Target
    73e36a2a49d6dd231a294b9d93aa7d8ebf272a17eb0a4a27d5f76f99ab7167e9.exe
  • Size 10.0MB
  • Sample240223-mpxeksfd34
  • SHA256 73e36a2a49d6dd231a294b9d93aa7d8ebf272a17eb0a4a27d5f76f99ab7167e9
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\73e36a2a49d6dd231a294b9d93aa7d8ebf272a17eb0a4a27d5f76f99ab7167e9.exe
    "C:\Users\Admin\AppData\Local\Temp\73e36a2a49d6dd231a294b9d93aa7d8ebf272a17eb0a4a27d5f76f99ab7167e9.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    PID:4576

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        NetBridge.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{35B83C9C-02E4-4026-A225-150E2EF609CA}.tmp\NetBridge.dll
        • Size 231KB
        • SHA256 98d795d55329b1057f4fd590468e648a8c34b620207fd9a0a6953f3e98d1ea43
        • MD5 SHA1 SHA512 SSDEEP

        7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{DB4ADBE0-2AD9-4bd1-9AC0-282703516266}.tmp\7z.dll
        • Size 1.1MB
        • SHA256 0edad8a1af22d5b97c1f324791c86243a6ecce7b5a9d2f30415af99aba9129c3
        • MD5 SHA1 SHA512 SSDEEP