Overview

overview

8

Static

static

3

Mocq Epic.exe

windows10-2004-x64

8

Resubmissions

18/08/2024, 04:38

240818-e9efhaydpm 8

18/08/2024, 04:36

240818-e8hfrswbke 3

Sharing

Copy URL Twitter E-mail

General

  • Target

    Mocq Epic.exe

  • Size

    306KB

  • Sample

    240818-e9efhaydpm

  • MD5

    fa26fae9f733a63cfcdf6fcc3127bb84

  • SHA1

    273e9e1928f10e1bbba028bd52ca21304a96f613

  • SHA256

    0ffdb148ab9c816bf4a643a727e02640878e2c98d4ff2b059e1bb7c3a9dcb48a

  • SHA512

    148d035f0eb05e5f5417ca92a0d7d136e3ad84f58971547757b058fcc7f948a77a6b6666818e5ab093106341688719e19385a5e0749798b8970df8af1be12f32

  • SSDEEP

    6144:mKuAN92+b1/2C5WxGojEydZ9CjuRDi2AyDf8QjT/LPK8/p+upNnVW4XyS3A8:juANX1eCPojEy79CjEDi2AyDf8QjDLPZ

Score
8/10
bootkitdiscoveryevasionpersistence

Malware Config

Targets

    • Target

      Mocq Epic.exe

    • Size

      306KB

    • MD5

      fa26fae9f733a63cfcdf6fcc3127bb84

    • SHA1

      273e9e1928f10e1bbba028bd52ca21304a96f613

    • SHA256

      0ffdb148ab9c816bf4a643a727e02640878e2c98d4ff2b059e1bb7c3a9dcb48a

    • SHA512

      148d035f0eb05e5f5417ca92a0d7d136e3ad84f58971547757b058fcc7f948a77a6b6666818e5ab093106341688719e19385a5e0749798b8970df8af1be12f32

    • SSDEEP

      6144:mKuAN92+b1/2C5WxGojEydZ9CjuRDi2AyDf8QjT/LPK8/p+upNnVW4XyS3A8:juANX1eCPojEy79CjEDi2AyDf8QjDLPZ

    Score
    8/10
    bootkitdiscoveryevasionpersistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks