Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 09:11
Static task
static1
Behavioral task
behavioral1
Sample
6837f512cdacef6feeb2a7c92cf79bd1047c5a1e1530fceea56f95174e196fea.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6837f512cdacef6feeb2a7c92cf79bd1047c5a1e1530fceea56f95174e196fea.exe
Resource
win10v2004-20240426-en
General
-
Target
6837f512cdacef6feeb2a7c92cf79bd1047c5a1e1530fceea56f95174e196fea.exe
-
Size
7.5MB
-
MD5
0be852528cd35c46e52851ba3fc30852
-
SHA1
2bec30a7b31e04794b3a534a0d711e21665d9f5f
-
SHA256
6837f512cdacef6feeb2a7c92cf79bd1047c5a1e1530fceea56f95174e196fea
-
SHA512
4db8aa8b0ee9fc02421e6b3f54f3b6700fdeaee15cc7ddbf900c752bc5a1ba08948c3bf5382d6f11f3028900d3ab61765d267bdff9dea879125d9adfce8276e9
-
SSDEEP
98304:mdGYuKuGLSkuAGvnvah+loowTcnOkhUwaq+6JRn/6i6sxuETOWIkI2dIvwpsVp:mdFhLSrnflZlnXaq+At6sxuwBI2dIt
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2088-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-65-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-63-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-61-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-59-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-57-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-55-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-52-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-48-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2088-40-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 6837f512cdacef6feeb2a7c92cf79bd1047c5a1e1530fceea56f95174e196fea.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2088 6837f512cdacef6feeb2a7c92cf79bd1047c5a1e1530fceea56f95174e196fea.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2088 6837f512cdacef6feeb2a7c92cf79bd1047c5a1e1530fceea56f95174e196fea.exe 2088 6837f512cdacef6feeb2a7c92cf79bd1047c5a1e1530fceea56f95174e196fea.exe 2088 6837f512cdacef6feeb2a7c92cf79bd1047c5a1e1530fceea56f95174e196fea.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6837f512cdacef6feeb2a7c92cf79bd1047c5a1e1530fceea56f95174e196fea.exe"C:\Users\Admin\AppData\Local\Temp\6837f512cdacef6feeb2a7c92cf79bd1047c5a1e1530fceea56f95174e196fea.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2088