General

  • Target

    overwriteb.exe

  • Size

    1.2MB

  • Sample

    240810-vxhkdstdle

  • MD5

    6b474a42696bd1965dc7f2a212bf6258

  • SHA1

    cf773ff66d93e50f5c87becc833c167c1860e565

  • SHA256

    c7230bb80217286fc85f8f174c02226c9b511901706ba7af6576400c7c7fc536

  • SHA512

    67755d39019a4bf738b70d1ea9faa8470f28840654f006ab00c72409070176080c5e75beb128f03189fe861fc0ffd31b60a6304634f7e5f0e903ba2998847a90

  • SSDEEP

    12288:VEcmBpMTqnYx6XZ7aUXYXVeCHkAVz5CntHsh9Z+DX87Kf+iXhhnCkAclRXhyxVUb:cBpMTqnYx6XZ7aU0VuMKf7nCkAMm

Malware Config

Targets

    • Target

      overwriteb.exe

    • Size

      1.2MB

    • MD5

      6b474a42696bd1965dc7f2a212bf6258

    • SHA1

      cf773ff66d93e50f5c87becc833c167c1860e565

    • SHA256

      c7230bb80217286fc85f8f174c02226c9b511901706ba7af6576400c7c7fc536

    • SHA512

      67755d39019a4bf738b70d1ea9faa8470f28840654f006ab00c72409070176080c5e75beb128f03189fe861fc0ffd31b60a6304634f7e5f0e903ba2998847a90

    • SSDEEP

      12288:VEcmBpMTqnYx6XZ7aUXYXVeCHkAVz5CntHsh9Z+DX87Kf+iXhhnCkAclRXhyxVUb:cBpMTqnYx6XZ7aU0VuMKf7nCkAMm

    • Possible privilege escalation attempt

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks