Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
08/05/2024, 09:20
General
-
Target
$_2_/bdrcdl.exe
-
Size
1.0MB
-
MD5
bb0db8559e5bd559870ac21bfae3d9b6
-
SHA1
8d8f4dff84f247020acdd28bc25af734cd58c1e5
-
SHA256
535caa0d8cb5de8c9ca3ecd52aef62bc708a7e9369adb1998f75dd26e60bbd42
-
SHA512
4a23e499c1af117fbef94c45aea88c47a45b7fc9b26e4e66ac7dbad7812575016473fa5f3384c6ad6c40088e53bef5e780924d797e597a14942fdd00e9df83a2
-
SSDEEP
24576:4R8EovXQZ9kPiNZxJa2D6sA5ctfwX6ShvB8pcGccpccUccL7cc2ccOcc9cc4Vcbc:ELoM42usyX/hvWcGccpccUccL7cc2ccJ
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$_2_\bdrcdl.exe"C:\Users\Admin\AppData\Local\Temp\$_2_\bdrcdl.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\$_2_\BugReport.exebugreport /silence /buginfo:00000490:00000498:04EEEC80:20242⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52B
MD53eb625808e00d419868989c37b89baff
SHA130e3c1efb93672502b89790dc080d33ef3dbb8ab
SHA256bdbc21dd3d8505270f9e4afa487ea90f53b6f0a2c109a1690013fa8070c8bd8d
SHA512755784065cd52f2bf0d1b9a99f925295804e938a51dd7012b69d2d731d6b5dc298956f9ad2fac56a9425d9dafa3bc6a46fdbb60bdfce8dc1f35302101aa50920
-
Filesize
76KB
-
Filesize
128KB
-
Filesize
424KB
-
Filesize
216KB
-
Filesize
968KB
-
Filesize
580KB
-
Filesize
424KB