c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082

Analysis

max time kernel
290s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082.exe
Size

567KB
MD5

58c170c5652d7cb0c0e5a942ee4d6cfa
SHA1

d7d81816a10a0036c5cc2df5e78366bcd3c4ddd4
SHA256

c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082
SHA512

4d99383dc469001d90e19b7bff7ec87594fe3b0b3684c8e1f3efa982bc111553b8c39a3cff95819314c345f70a961e0a17c00e429f5ecae6fd8e41141bf6440c
SSDEEP

12288:FSL69zs1DwJ2Y+SDBeBUlEUtxrGNZMgOspvLBJRa5c:Fd9zs1DhY+QYuEUmZMULV

Score

10^/10

bootkit persistence

Malware Config

Signatures

Pitou 2 IoCs

Pitou.

Processes:

resource	yara_rule
behavioral1/memory/2288-4-0x0000000000400000-0x0000000002C70000-memory.dmp	pitou
behavioral1/memory/2288-5-0x0000000000400000-0x0000000002C70000-memory.dmp	pitou

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082.exe

C:\Users\Admin\AppData\Local\Temp\c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082.exe
"C:\Users\Admin\AppData\Local\Temp\c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:2288

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2288-1-0x0000000002CF0000-0x0000000002DF0000-memory.dmp

Filesize
1024KB

Download
memory/2288-2-0x00000000002B0000-0x000000000031B000-memory.dmp

Filesize
428KB

Download
memory/2288-4-0x0000000000400000-0x0000000002C70000-memory.dmp

Filesize
40.4MB

Download
memory/2288-5-0x0000000000400000-0x0000000002C70000-memory.dmp

Filesize
40.4MB

Download
memory/2288-7-0x0000000002CF0000-0x0000000002DF0000-memory.dmp

Filesize
1024KB

Download