General

  • Target

    LOL.exe

  • Size

    251KB

  • Sample

    240518-f8jjhadg9t

  • MD5

    7da870c0e576e4c1efcdecc72cd3b6c1

  • SHA1

    50075bd0691ac4cc1fdd49419596a50e774e9d7f

  • SHA256

    8336cd63887054c04ceb4279c608847a21dcdc96ed961704205dc655256ea85d

  • SHA512

    f4a7646ba9f5c07e7e70d7c3a252600c0f5872dfe7644f5d152f606b61e85cc61a169e03eef8fd4cb47de8187075269d8f0e6aacd3edbc939f12c9032ea68b18

  • SSDEEP

    6144:/5VP9Ge3+hoAvdeJBbLncZiJhSQnLEWyvkwel:/5393whFOBbxJkQwWyvCl

Malware Config

Targets

    • Target

      LOL.exe

    • Size

      251KB

    • MD5

      7da870c0e576e4c1efcdecc72cd3b6c1

    • SHA1

      50075bd0691ac4cc1fdd49419596a50e774e9d7f

    • SHA256

      8336cd63887054c04ceb4279c608847a21dcdc96ed961704205dc655256ea85d

    • SHA512

      f4a7646ba9f5c07e7e70d7c3a252600c0f5872dfe7644f5d152f606b61e85cc61a169e03eef8fd4cb47de8187075269d8f0e6aacd3edbc939f12c9032ea68b18

    • SSDEEP

      6144:/5VP9Ge3+hoAvdeJBbLncZiJhSQnLEWyvkwel:/5393whFOBbxJkQwWyvCl

    • Disables Task Manager via registry modification

    • Possible privilege escalation attempt

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

    • Modifies system executable filetype association

    • Registers COM server for autorun

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

2
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Tasks