Overview

overview

6

Static

static

1

2024-04-20...ia.exe

windows7-x64

6

2024-04-20...ia.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    20-04-2024 07:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-20_dabadfba992c0ed5b5035adc866e901d_karagany_mafia.exe

  • Size

    1.6MB

  • MD5

    dabadfba992c0ed5b5035adc866e901d

  • SHA1

    436c4d0dd8b4c7ed90614b027d72aa71992fe9a9

  • SHA256

    c119c8e23bfc2044bbd902ba4633ca80d1b5881c6459a56adc87846c5100c508

  • SHA512

    7c88e207d72e8e03deaba3c84ca009057a46c00141bce04e376b586bbd5fefed4963a1ef2cc7fc335301b5c0d9cda4e96f8371fb14edca1815438f10116d4bb0

  • SSDEEP

    24576:4nD2ecdSF681s5vg987LzYqXdKLBvkupIcbS6Txv7ML9/qvs4igYF:gFU5I987LFXdKLiWIce6TVML9ZM0

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-20_dabadfba992c0ed5b5035adc866e901d_karagany_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-20_dabadfba992c0ed5b5035adc866e901d_karagany_mafia.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:2936

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Documents\Baidu\Common\I18N\conf.db
    Filesize

    367B

    MD5

    7ea9554bc2cef13cadc6769f58d8de98

    SHA1

    91352d791162bf8309a61c0aa620b5c8e19ee449

    SHA256

    c9ea65df19cd240aaa0db3e269f15c83ecceb5b893f6a995a3e6d943a74d021b

    SHA512

    fb31cc40653a53b63cf4bb7da0cf355589a2c6381ad338a133e5a757dc9d635a1ffc9f1e72b7043675b068a9394cb6f27cb732aab0c953059662fd2237eb70ce

    Download Submit
  • memory/2936-4-0x0000000000110000-0x0000000000111000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2936-13-0x0000000000110000-0x0000000000111000-memory.dmp
    Filesize

    4KB

    Download