5557bc2b4439f7e348cc30dfab22714f051296d8906691256d1280715cb40825 | Triage

Sharing

General

Target

be8cfc2526efcc21da279e97faac0ccd
Size

1.8MB
Sample

240310-n449eace4w
MD5

be8cfc2526efcc21da279e97faac0ccd
SHA1

cde7dc54797056c2afcb852fa178db49fa529657
SHA256

5557bc2b4439f7e348cc30dfab22714f051296d8906691256d1280715cb40825
SHA512

5951360882c7790700d6907dc9915f181f9446538cb44c03a59f0cf45b53d85a1ad05293b4b4c24c59771fe73fb6f1e0134968c640db8db3f610da3fe1f00bed
SSDEEP

49152:RMumM6xRN9GfpB9EbWMVjHg9/chd/ww1vQr/wi6LfUwRD:qZRSfprEW/0zisLtRD

Score

7^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  be8cfc2526efcc21da279e97faac0ccd
- Size
  
  1.8MB
- MD5
  
  be8cfc2526efcc21da279e97faac0ccd
- SHA1
  
  cde7dc54797056c2afcb852fa178db49fa529657
- SHA256
  
  5557bc2b4439f7e348cc30dfab22714f051296d8906691256d1280715cb40825
- SHA512
  
  5951360882c7790700d6907dc9915f181f9446538cb44c03a59f0cf45b53d85a1ad05293b4b4c24c59771fe73fb6f1e0134968c640db8db3f610da3fe1f00bed
- SSDEEP
  
  49152:RMumM6xRN9GfpB9EbWMVjHg9/chd/ww1vQr/wi6LfUwRD:qZRSfprEW/0zisLtRD
Score

7^/10

bootkit discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/FindProcDLL.dll
- Size
  
  3KB
- MD5
  
  8614c450637267afacad1645e23ba24a
- SHA1
  
  e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA256
  
  0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- SHA512
  
  af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  d753362649aecd60ff434adf171a4e7f
- SHA1
  
  3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
- SHA256
  
  8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
- SHA512
  
  41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
- SSDEEP
  
  192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  4KB
- MD5
  
  99f345cf51b6c3c317d20a81acb11012
- SHA1
  
  b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA256
  
  c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- SHA512
  
  937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  94KB
- MD5
  
  0061a96c8ff17ad0927aae65b5dfe06b
- SHA1
  
  9d1bd69d930ccda683e6b7c2c0d1dbe3b54861fe
- SHA256
  
  2aaef1ed8a25097b3a807568daeffd3320fa29d6de66df90a57beaa8df8949cf
- SHA512
  
  c6b887a4e1682ba1e126c93bc4d886c7f1ce392f97866e631c5b8a945824cbefc9af2429a14c2dac3b16d97bd33195d4378a7e92ae53fdeb47197452d4d90fc4
- SSDEEP
  
  1536:0yy+i55jAPWrI5qXgcAZ5c4DB5G7NXE9eOO2xwN:3y+i5i+kEQcAZXGx0cr2xw
Score

3^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  10KB
- MD5
  
  56a321bd011112ec5d8a32b2f6fd3231
- SHA1
  
  df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA256
  
  bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- SHA512
  
  5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP
  
  192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
Score

3^/10
behavioral11 behavioral12
- Target
  
  config.dll
- Size
  
  1.6MB
- MD5
  
  86d6bdfc762e0eb60606d8c227a9a50b
- SHA1
  
  0eb0f7cbceed4ba18be76108be2480693cb94d0c
- SHA256
  
  09a6579d86a8d7627229e336f846cfc71f5d76f0c5be92ee4125be719f659530
- SHA512
  
  4e83cf8ac1bd38058dd0d45e09282edf284f98639c7e25f70e69a3ac8686c585dfde6389ddb2c6617b0d102d6f9845817b565593ab61b8ff91c733aafe7b11a5
- SSDEEP
  
  24576:tPH7Ov1dGQ1OpoQ5MkgpMpMpqura2up+wyp9J/Qux7dXkMCM0VH1+KAxA:hgdTwpD5y2P+T0s7yMCM0VH1oxA
Score

5^/10
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  
  ddqjh_wqeqd.exe
- Size
  
  31KB
- MD5
  
  c35a26f177a905feb02adbb2d7db5c00
- SHA1
  
  70f5a756fa020fedad901014206f4069cdd024c3
- SHA256
  
  362a34664946a5fe654fe5f3286392d88c256962a1a0dc4342dc4fd0db47f299
- SHA512
  
  79c62acc778f131ae4ab070c309a4452c2d84b22b06ca499e5bf158a80aff20f0c1fcbb810374f8c1b9b8314aecc52f7818e7a241d354c0675ac2e73e8c233c1
- SSDEEP
  
  384:BUthoe0T99FVAL6zpA7AYDhwaEk3i8FnI9Y/QwapWOIl8fKP1AePnYPL4odu:BLe0FFzp4Df5X/QdpWBl8fKP1jwdu
Score

1^/10
behavioral15 behavioral16
- Target
  
  iconAnimate.exe
- Size
  
  305KB
- MD5
  
  522d2e48436fd6b3c2d4067f3422c9e9
- SHA1
  
  0523bd542aee776b28b69be2fa7efe95ee4ab9bf
- SHA256
  
  da4d70d77bd02e4a61d8ba2c51bd88215c483a4616dcf3d292402ed6b7ed0a61
- SHA512
  
  adfff2455ba78ede16e777b52c427628134e6f4f8cfc5dd0baa5f72e3d842f19b729eed24d8d8aaa098e61dd619474e88a1d9ed06619e5ac33061e185473287b
- SSDEEP
  
  6144:VlYIXLG7M9wlV0ukmKiuwv11rf1Ar3Q++5n:Vpi7M9yQiuwNV1Az+5n
Score

1^/10
behavioral17 behavioral18
- Target
  
  iconTips.exe
- Size
  
  280KB
- MD5
  
  1f91eaa41903b30a4dc33e882daef90d
- SHA1
  
  968b122b9e445e7983f4a58b3e5c6dc5136588c3
- SHA256
  
  39e10b8ceeca062152088a7b687695a52a34e0aa57ed35afdf37b6145a75c388
- SHA512
  
  b05bf47c3ad7d1027528526d60dcf8513a7d6a57a76b29e7c21e3d9c0868e9927033bb1fd45a661d1ee779b4a4245224f351fb45ee05c6e0944d4f8f36a7963e
- SSDEEP
  
  3072:+JtXXgYV8UAwCP3f3IF4YE/hgzNM4Rdj1MqgOMPVqef5w6Zl:+HAYGNMpEWMAj1MqgOMPA+5n
Score

1^/10
behavioral19 behavioral20
- Target
  
  uninst.exe
- Size
  
  290KB
- MD5
  
  82d67e901c99057e9cebe02d5e954377
- SHA1
  
  de93df7d7e3d73b2d85fe1cdcbed0b596d0d5da9
- SHA256
  
  201bdb7cc7b97c26477ae814a4d16e762a3e54cfb9bc7cb4de5d6fd4f72d2ba2
- SHA512
  
  9315f18462e2c9f958f7fd164d561c641bdf09331394a80833b0bd2a61bffdfa73b0564d5061eae565fb3489dd7d5d1178151c8dbb18c4a4b9323f150363fcd6
- SSDEEP
  
  6144:B8LxBw+5EHN6sLROkcgbubj9g3ZX23SAMKVaBkM:9+5EtTLROSbuNg3EKKZM
Score

7^/10

bootkit persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/FindProcDLL.dll
- Size
  
  3KB
- MD5
  
  8614c450637267afacad1645e23ba24a
- SHA1
  
  e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA256
  
  0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- SHA512
  
  af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
Score

3^/10
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  4KB
- MD5
  
  99f345cf51b6c3c317d20a81acb11012
- SHA1
  
  b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA256
  
  c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- SHA512
  
  937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
Score

3^/10
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  10KB
- MD5
  
  56a321bd011112ec5d8a32b2f6fd3231
- SHA1
  
  df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA256
  
  bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- SHA512
  
  5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP
  
  192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
Score

3^/10
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/inetc.dll
- Size
  
  20KB
- MD5
  
  50fdadda3e993688401f6f1108fabdb4
- SHA1
  
  04a9ae55d0fb726be49809582cea41d75bf22a9a
- SHA256
  
  6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
- SHA512
  
  e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
- SSDEEP
  
  384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
Score

3^/10
behavioral29 behavioral30
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  f832e4279c8ff9029b94027803e10e1b
- SHA1
  
  134ff09f9c70999da35e73f57b70522dc817e681
- SHA256
  
  4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061
- SHA512
  
  bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d
- SSDEEP
  
  96:ytJ6tC4jcY5rKhkfL9SYdKkcxM2DjDf3GEfKvBKav+Yx4yndY7ndS27gA:yyj6QS8HREf+BYYxbdqn420
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2

bootkitdiscoverypersistence

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

bootkitpersistence

behavioral22

bootkitpersistence

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32