General
-
Target
hl.exe
-
Size
29.6MB
-
Sample
240714-hrw5da1alm
-
MD5
d5738b50bc6cf709f96cd9f9e7f4e50c
-
SHA1
8b588497b7b67807fadf1834c16e9f554f7fbf4b
-
SHA256
47e0da4442134986f0b78bc8a0161026b1bd77e748dbf2757eb711886b9f9c44
-
SHA512
fdce18b94bd8ee5f63d9c87ceb6a79f9424eb3fd61c55add3414c065e7d91f9f94ba2ad4ce04fcd8d860887ce8617598413e171b34ad205b6068f16513197e24
-
SSDEEP
786432:nmWxUTU+QOpwZS1nkZPLtghhtdK3hu0c:FIzGZakpLtghhtqpc
Static task
static1
Behavioral task
behavioral1
Sample
hl.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
hl.exe
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
hl.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
hl.exe
Resource
win11-20240709-en
Malware Config
Targets
-
-
Target
hl.exe
-
Size
29.6MB
-
MD5
d5738b50bc6cf709f96cd9f9e7f4e50c
-
SHA1
8b588497b7b67807fadf1834c16e9f554f7fbf4b
-
SHA256
47e0da4442134986f0b78bc8a0161026b1bd77e748dbf2757eb711886b9f9c44
-
SHA512
fdce18b94bd8ee5f63d9c87ceb6a79f9424eb3fd61c55add3414c065e7d91f9f94ba2ad4ce04fcd8d860887ce8617598413e171b34ad205b6068f16513197e24
-
SSDEEP
786432:nmWxUTU+QOpwZS1nkZPLtghhtdK3hu0c:FIzGZakpLtghhtqpc
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1Pre-OS Boot
1Bootkit
1