Overview

overview

7

Static

static

3

Bootstrapper.exe

windows7-x64

6

Bootstrapper.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bootstrapper.exe

  • Size

    793KB

  • Sample

    240726-wckdxsxemd

  • MD5

    d674b62b359b2ec81398348904f8bee9

  • SHA1

    609d29c3d5503bc382ab55188e67e002eb8270a7

  • SHA256

    95486d06db5126eb557c563b5597e08b236634f75853a6491c485cb64cf28ae2

  • SHA512

    a4fe0e357e5c44ebdf87fa0273266d35ff181e4ee5c041708f44b09f5225f5841b8cb677eda903b2869fa4a86d0b39ff7b371949928bb0a1cc4cbb008f978cad

  • SSDEEP

    12288:d63MnScwI8yPExQwa05tOocHFj6rftMH6n6rmP2vCSpm5r8d:MNcRPPEftOocHFj6JMHOdy

Score
7/10
discovery

Malware Config

Targets

    • Target

      Bootstrapper.exe

    • Size

      793KB

    • MD5

      d674b62b359b2ec81398348904f8bee9

    • SHA1

      609d29c3d5503bc382ab55188e67e002eb8270a7

    • SHA256

      95486d06db5126eb557c563b5597e08b236634f75853a6491c485cb64cf28ae2

    • SHA512

      a4fe0e357e5c44ebdf87fa0273266d35ff181e4ee5c041708f44b09f5225f5841b8cb677eda903b2869fa4a86d0b39ff7b371949928bb0a1cc4cbb008f978cad

    • SSDEEP

      12288:d63MnScwI8yPExQwa05tOocHFj6rftMH6n6rmP2vCSpm5r8d:MNcRPPEftOocHFj6JMHOdy

    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks