Analysis

  • max time kernel
    292s
  • max time network
    188s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17/05/2024, 00:35

General

  • Target

    f4ec4234767ef94ed013320727254216c141bc8612cbc3d83e28b5c94ddb39aa.exe

  • Size

    1.0MB

  • MD5

    95efdc1c5013fed14f8b89a2f0ed0dfd

  • SHA1

    d403544c0eb992522301948004465c453b78c2b3

  • SHA256

    f4ec4234767ef94ed013320727254216c141bc8612cbc3d83e28b5c94ddb39aa

  • SHA512

    db29d5d7fca7d8e01076b7e4022d5a3ce8c91b6ac46120e5311c6ede44ac5fd7d8778d30dc6e2e51e44499e544aa19406e7297d7801e81ed74cebcc478f277c7

  • SSDEEP

    24576:A9dNUQFgv1LBrTTjkkuUCxPHsyILO3HCpxlunGe:ArN9GvvrPSx0bLOSpx8

Score
10/10

Malware Config

Signatures

  • Pitou 2 IoCs

    Pitou.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4ec4234767ef94ed013320727254216c141bc8612cbc3d83e28b5c94ddb39aa.exe
    "C:\Users\Admin\AppData\Local\Temp\f4ec4234767ef94ed013320727254216c141bc8612cbc3d83e28b5c94ddb39aa.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:5104

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/5104-0-0x0000000002330000-0x0000000002331000-memory.dmp

          Filesize

          4KB

        • memory/5104-1-0x0000000000400000-0x000000000050F000-memory.dmp

          Filesize

          1.1MB

        • memory/5104-2-0x0000000002500000-0x0000000002570000-memory.dmp

          Filesize

          448KB

        • memory/5104-3-0x0000000000400000-0x000000000046F000-memory.dmp

          Filesize

          444KB

        • memory/5104-4-0x0000000000400000-0x000000000050F000-memory.dmp

          Filesize

          1.1MB

        • memory/5104-5-0x0000000002330000-0x0000000002331000-memory.dmp

          Filesize

          4KB

        • memory/5104-6-0x0000000000400000-0x000000000050F000-memory.dmp

          Filesize

          1.1MB

        • memory/5104-8-0x0000000000400000-0x000000000046F000-memory.dmp

          Filesize

          444KB