Overview

overview

10

Static

static

3

boostware ...mp.exe

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    boostware free temp.exe

  • Size

    3.8MB

  • Sample

    240602-2g8vzahe3w

  • MD5

    55e116dc73972f70c67f6f25074e47df

  • SHA1

    20d39d38c6633ddc6b89528d71a232999a94ee71

  • SHA256

    820d1f3c6a051a323cc449dc09b1db6d1bda95e9124838557f7f91f551cf981a

  • SHA512

    806831c8ae1707efd23194cdbca1144b998f3bc7944ae5bf27d84d0ce4f3f481d62d04e1249f97502edd5470219995592a424c0b6c433a18509bf609a17f3775

  • SSDEEP

    49152:PTOB4ynYygOvXsMruROZyUpWvWOLZkORe7VX:6l

Score
10/10
evasionexecutionpersistencephishing

Malware Config

Targets

    • Target

      boostware free temp.exe

    • Size

      3.8MB

    • MD5

      55e116dc73972f70c67f6f25074e47df

    • SHA1

      20d39d38c6633ddc6b89528d71a232999a94ee71

    • SHA256

      820d1f3c6a051a323cc449dc09b1db6d1bda95e9124838557f7f91f551cf981a

    • SHA512

      806831c8ae1707efd23194cdbca1144b998f3bc7944ae5bf27d84d0ce4f3f481d62d04e1249f97502edd5470219995592a424c0b6c433a18509bf609a17f3775

    • SSDEEP

      49152:PTOB4ynYygOvXsMruROZyUpWvWOLZkORe7VX:6l

    Score
    10/10
    evasionexecutionpersistencephishing

    • Disables service(s)

      evasionexecution

    • Downloads MZ/PE file

    • Sets DLL path for service in the registry

      persistence

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks