Overview

overview

6

Static

static

1

2024-04-20...ia.exe

windows7-x64

6

2024-04-20...ia.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    142s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 07:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-20_dabadfba992c0ed5b5035adc866e901d_karagany_mafia.exe

  • Size

    1.6MB

  • MD5

    dabadfba992c0ed5b5035adc866e901d

  • SHA1

    436c4d0dd8b4c7ed90614b027d72aa71992fe9a9

  • SHA256

    c119c8e23bfc2044bbd902ba4633ca80d1b5881c6459a56adc87846c5100c508

  • SHA512

    7c88e207d72e8e03deaba3c84ca009057a46c00141bce04e376b586bbd5fefed4963a1ef2cc7fc335301b5c0d9cda4e96f8371fb14edca1815438f10116d4bb0

  • SSDEEP

    24576:4nD2ecdSF681s5vg987LzYqXdKLBvkupIcbS6Txv7ML9/qvs4igYF:gFU5I987LFXdKLiWIce6TVML9ZM0

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-20_dabadfba992c0ed5b5035adc866e901d_karagany_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-20_dabadfba992c0ed5b5035adc866e901d_karagany_mafia.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:3540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Documents\Baidu\Common\I18N\conf.db
    Filesize

    403B

    MD5

    e09d9819afcc9bc5cb3ba1340bf539c5

    SHA1

    2d5ca69c8c331f9636da7408a28b5fcb681c1cb7

    SHA256

    51b6afd36a9d6c9678ea6a3a74c99d94fce6fdc64d77035e0f31f854521a7305

    SHA512

    fee1144f5b397b43215501a213185e5072f954aa02981f63c738d38d0f8d69c7c6e3808c7f7d4b965a6943317af9274a72121d1e62309b0be95affe117a59a5c

    Download Submit
  • memory/3540-4-0x0000000002930000-0x0000000002931000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3540-14-0x0000000002930000-0x0000000002931000-memory.dmp
    Filesize

    4KB

    Download