843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947

Analysis

max time kernel
24s
max time network
27s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe
Size

139KB
MD5

5bd4b79bcdc6c1bf30ea6105bc90ac30
SHA1

356a275e8792c795bb76dbcf8342b046dd37314e
SHA256

843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947
SHA512

961d10c2d713a76f99289167c6da783de59e69e840b9c475333c84c0f3c234830c7767a1890bc37ce1b1cfa6c15935958a288330ad0c3bc2ca303bcd8faba2b0
SSDEEP

3072:rYU94fDhmJCSV+DwmKKxM/jqD0RJ/DX6U9l8MDuHGdDGo3s:rcgawmKEM/ucbmMDIbEs

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Loads dropped DLL 5 IoCs

Processes:

843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe

pid	Process
1820	843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe
1820	843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe
1820	843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe
1820	843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe
1820	843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe

C:\Users\Admin\AppData\Local\Temp\843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe
"C:\Users\Admin\AppData\Local\Temp\843c0c3edae1d5ff1b0ada4015d957d2009137857aeff22f672488b023d8c947N.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoEBF5.tmp\Md5dll.dll

Filesize
8KB

MD5
a7d710e78711d5ab90e4792763241754

SHA1
f31cecd926c5d497aba163a17b75975ec34beb13

SHA256
9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2

SHA512
f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0

Download Submit
\Users\Admin\AppData\Local\Temp\nsoEBF5.tmp\NSISdl.dll

Filesize
14KB

MD5
f716c100f551ac57e862c7b72dfe2b87

SHA1
a6fb358fd268507535178a8827943f1905f2606b

SHA256
d92b88c3096a5d09c1f9744b62668d588cc8b1992fd88fa5c88c4636121c9f44

SHA512
3d841154199d59d0f9cbf15ec4146de1e967d4292f3a78db8764afab5a9a242f38e1f0e1bf3943d06e5be5018a35cf7c441744a8cf542cb4001ae6b375f244cc

Download Submit
\Users\Admin\AppData\Local\Temp\nsoEBF5.tmp\System.dll

Filesize
10KB

MD5
4fbb4a2cd711fc1fe84f3dc30c491dc9

SHA1
888e01ae6e64e7326f88df9a30587f699eab154a

SHA256
c3b05f4faf5e8903d5b4cb4a8ce4bbf2e8144725b98d8787d51c117b6efa9bc2

SHA512
92dcf99672a5935065df6492e27abb653679f1db6dcddfde87cd14260c94a870327826b23cc2f338381b3eb53d07c1a3867806f6ff94533db5195b895a856847

Download Submit
\Users\Admin\AppData\Local\Temp\nsoEBF5.tmp\xID.dll

Filesize
3KB

MD5
76d2faad042161f24b6c9c78de3bd265

SHA1
12518e1ba9e96dc202e6c12267650e52f1058664

SHA256
0b31ee64cab09f19e672b3d7f7d11516fe1cd373c2e2861a955b84d054c0507f

SHA512
cea11e232eabf2d525b09cae03e8f8a0b83f92a718f8cf92308d7f31bd4f92ab96c34c1107dbed14517f17ee41a84afd3433f42148edebfbaeca78a517b7e508

Download Submit