Overview

overview

6

Static

static

3

CODESO~2.exe

windows7-x64

6

CODESO~2.exe

windows10-2004-x64

6

Codesoft.exe

windows7-x64

1

Codesoft.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2024, 06:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CODESO~2.exe

  • Size

    3.0MB

  • MD5

    9233021334cb0dd2227462173423612c

  • SHA1

    338b8818f7b867b78decb18537cf305d69850e4a

  • SHA256

    682b6c51b1529945187c11fbb6852ad020196e7561009629ab4fe043a97e7dc3

  • SHA512

    f0b1bb69658d5c80167e0a554513b71a935aa5a3d036e333581586b9d2d70900fbd7a32b97d44e423c2d45b250036c723fc143612aae919680cef6d5414c10b3

  • SSDEEP

    24576:vYHbFKGjgc6ApaH8zAtR4evImL9vpuvnjvzA3FyvbAAhimM0bdzr98Oiy1:gHBKGjgdApt7hUvpuvnj4Kp/M099iQ

Score
6/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CODESO~2.exe
    "C:\Users\Admin\AppData\Local\Temp\CODESO~2.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Users\Admin\AppData\Local\Temp\CODESO~2.exe
      "C:\Users\Admin\AppData\Local\Temp\CODESO~2.exe"
      2⤵
        PID:1856

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\PWSSettings.ini
      Filesize

      145B

      MD5

      2991e573b59085e011c1407337a78401

      SHA1

      3df84861d0a573db8a5fe47660b5ea3824e94f1d

      SHA256

      d7ee7a2a1157e7d0cfdba0febb9eacfad0ccb6d6b391fa8e565be9dc878aff33

      SHA512

      0eb08fd3aab466397be1a1e7b2fbb21cee5743c577fa14d552edda94221035e762f1e7090142052f7f5c648a180ddc91c596b6a55d2f48e1ec5dfe0a1e8d1b73

      Download Submit

    • memory/2332-0-0x0000000000400000-0x0000000000702000-memory.dmp

      Filesize

      3.0MB

      Download

    • memory/2332-9-0x0000000000400000-0x0000000000702000-memory.dmp

      Filesize

      3.0MB

      Download

    • memory/2332-10-0x0000000000400000-0x0000000000702000-memory.dmp

      Filesize

      3.0MB

      Download