Analysis
-
max time kernel
292s -
max time network
303s -
platform
windows10-1703_x64 -
resource
win10-20240319-en -
resource tags
arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system -
submitted
18-04-2024 23:09
Static task
static1
Behavioral task
behavioral1
Sample
c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082.exe
Resource
win10-20240319-en
General
-
Target
c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082.exe
-
Size
567KB
-
MD5
58c170c5652d7cb0c0e5a942ee4d6cfa
-
SHA1
d7d81816a10a0036c5cc2df5e78366bcd3c4ddd4
-
SHA256
c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082
-
SHA512
4d99383dc469001d90e19b7bff7ec87594fe3b0b3684c8e1f3efa982bc111553b8c39a3cff95819314c345f70a961e0a17c00e429f5ecae6fd8e41141bf6440c
-
SSDEEP
12288:FSL69zs1DwJ2Y+SDBeBUlEUtxrGNZMgOspvLBJRa5c:Fd9zs1DhY+QYuEUmZMULV
Malware Config
Signatures
-
Pitou 2 IoCs
Pitou.
Processes:
resource yara_rule behavioral2/memory/5116-3-0x0000000000400000-0x0000000002C70000-memory.dmp pitou behavioral2/memory/5116-5-0x0000000000400000-0x0000000002C70000-memory.dmp pitou -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 c8d871db88fe7e80b9463723a2a21354fb9ae09b51b1582c90a67b8c2cd7c082.exe