2436fc18abe95ce13085fdfecc5789bcf7e38d452688ebfb7b310ad0b8663211

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00080f608e789213de2c506a2a2ddae0N.exe
Size

75KB
MD5

00080f608e789213de2c506a2a2ddae0
SHA1

8f59b0d3743d5b9d2a06b5f2b9dae82a90f5e458
SHA256

2436fc18abe95ce13085fdfecc5789bcf7e38d452688ebfb7b310ad0b8663211
SHA512

b2f5c266169e6b3e83ec2866a8555d80ff1cf22d3f7cde3214a1d245df1bff725b17fd8b268f70c4f97c424c91c604a928599f9ea2bc505a85e4961aa242c2d2
SSDEEP

1536:jYTmwVUsW7dtJMHy0DxmJWMH8fm0eGWmgo5D2gZ6RaLZ32:US17XJiDxmJWfmFGWC1ZoEt2

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2392	00080f608e789213de2c506a2a2ddae0N.exe
2392	00080f608e789213de2c506a2a2ddae0N.exe
2392	00080f608e789213de2c506a2a2ddae0N.exe
2392	00080f608e789213de2c506a2a2ddae0N.exe
2392	00080f608e789213de2c506a2a2ddae0N.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	00080f608e789213de2c506a2a2ddae0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00080f608e789213de2c506a2a2ddae0N.exe

C:\Users\Admin\AppData\Local\Temp\00080f608e789213de2c506a2a2ddae0N.exe
"C:\Users\Admin\AppData\Local\Temp\00080f608e789213de2c506a2a2ddae0N.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst896C.tmp\Md5dll.dll

Filesize
8KB

MD5
a7d710e78711d5ab90e4792763241754

SHA1
f31cecd926c5d497aba163a17b75975ec34beb13

SHA256
9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2

SHA512
f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0

Download Submit
\Users\Admin\AppData\Local\Temp\nst896C.tmp\NSISdl.dll

Filesize
14KB

MD5
2a2af69379ed269c61893e8146e18f52

SHA1
03264b45960d3f1fde4b031db47ab7a3f863713d

SHA256
e323b74c36dc52c2a3fbda49d998744cf64cab102f0d72796472ab55d2c784d4

SHA512
49388047397e33f1ed502bd0c5e61b98b33881f794fb52ca229db5b589af9ecb370e9043e2143dcb62cd9d00df6cacc89589734c83f9fda0ceb3f216c0bedeab

Download Submit
\Users\Admin\AppData\Local\Temp\nst896C.tmp\System.dll

Filesize
10KB

MD5
82f7926fd7d12e3eb8ed7b5232bcf956

SHA1
6065fc921b742cc86c77ce2533fc1d17359eb45e

SHA256
604b5e75f43ffae8f172018cdd8f136392d9c52ae0c100d27ef537bb2dfb3984

SHA512
b31a63ebbda8f147c32d8336c5ecde8c5261ad5526b01926d7cd74b7a9a1348da56e180e53d20e1e300daca76f9511f24d6e695550b705b7650c239e5b6e76c7

Download Submit
\Users\Admin\AppData\Local\Temp\nst896C.tmp\xID.dll

Filesize
3KB

MD5
76d2faad042161f24b6c9c78de3bd265

SHA1
12518e1ba9e96dc202e6c12267650e52f1058664

SHA256
0b31ee64cab09f19e672b3d7f7d11516fe1cd373c2e2861a955b84d054c0507f

SHA512
cea11e232eabf2d525b09cae03e8f8a0b83f92a718f8cf92308d7f31bd4f92ab96c34c1107dbed14517f17ee41a84afd3433f42148edebfbaeca78a517b7e508

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads