2d0bd517d460b20621bc534eb125b76c58732e9aa287bd907571746d748eb4ee

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2d0bd517d460b20621bc534eb125b76c58732e9aa287bd907571746d748eb4ee.dll
Size

4.8MB
MD5

3d4b901fab283e8ba42f7dc66fdf0793
SHA1

612ab75c80544d84e8e00cc6d6ed3393aa60d4f7
SHA256

2d0bd517d460b20621bc534eb125b76c58732e9aa287bd907571746d748eb4ee
SHA512

6398769a46a3d7135778ea5d804c62b61d9b9f7eb83fecc491a372f3a3c2d56ca8b9b4d73eb9055bdfa4fcddb34e4fe6db01b5ddc09bd15d63c3d09d667101d7
SSDEEP

98304:VkHauFV74BtQPGVhRiCu/CVUdVEy9qMBNP/qxct8q0rndwrndHAbs8y:S6U4UdVEy9qMBNLtaIKol

Score

8^/10

bootkit persistence

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2972	rundll32.exe
4	2972	rundll32.exe
8	2972	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
2972	rundll32.exe
2972	rundll32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2972	2904	rundll32.exe	28
PID 2904 wrote to memory of 2972	2904	rundll32.exe	28
PID 2904 wrote to memory of 2972	2904	rundll32.exe	28
PID 2904 wrote to memory of 2972	2904	rundll32.exe	28
PID 2904 wrote to memory of 2972	2904	rundll32.exe	28
PID 2904 wrote to memory of 2972	2904	rundll32.exe	28
PID 2904 wrote to memory of 2972	2904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d0bd517d460b20621bc534eb125b76c58732e9aa287bd907571746d748eb4ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d0bd517d460b20621bc534eb125b76c58732e9aa287bd907571746d748eb4ee.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\netul.dll

Filesize
109KB

MD5
3864824810a11b5bf87a8b367ede0403

SHA1
100e27c300f0d14e3232185fcd833f2d5a87cb2a

SHA256
5af73ea60bce9c90a633b5dc21c81e62f9d6301b6de19d2e145185f210b8bcc1

SHA512
06744aaa1c2528844c343bc5428088432b70921def6a7801e3cd7e3d6c90a1ff7fb9865fec74821d693ef6156931713469e02c3da7734581b8d8d84245b9dbf0

Download Submit
\Users\Admin\AppData\Local\Temp\{08558A9A-5F13-4ff2-9B2D-023DB1A01E21}.tmp\7z.dll

Filesize
1.1MB

MD5
5e9acabc72b82e2020626d8d72c13ac4

SHA1
255598e95ba298834bca1fbce7e6e576e4b81e73

SHA256
de4303106ffb4e11141f72270f7e992737ed49b2993f56fb0b7f7db8ae03eeaf

SHA512
4fdafb37e16b3c5425aaa126a04ddf82d70f5bddf59ba3f6358323b8fbd0388f4236179fd3fdca4cfcacda4e5bcd27109c8d6d1d87ab0da65a19b2318639fbc9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads