Mebromi
December 21, 2023 ยท View on GitHub
| ID | X0013 |
| Type | Bootkit |
| Aliases | None |
| Platforms | Windows |
| Year | 2011 |
| Associated ATT&CK Software | Mebromi |
Mebromi
A BIOS bootkit.
ATT&CK Techniques
| Name | Use |
|---|---|
| Discovery::Process Discovery (T1057) | Mebromi enumerates processes. [2] |
| Discovery::System Service Discovery (T1007) | Mebromi queries a service status. [2] |
| Execution::Shared Modules (T1129) | Mebromi links functions at runtime on Windows. [2] |
| Execution::System Services::Service Execution (T1569.002) | Mebromi interacts with a driver via control codes. [2] |
| Impact::Service Stop (T1489) | Mebromi stops services. [2] |
| Persistence::Create or Modify System Process::Windows Service (T1543.003) | Mebromi starts services. [2] |
See ATT&CK: Mebromi - Techniques Used.
Enhanced ATT&CK Techniques
| Name | Use |
|---|---|
| Defense Evasion::Bootkit (F0013) | An MBR bootkit and a BIOS bootkit targeting Award BIOS. [1] |
| Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02) | Mebromi encodes data using XOR. [2] |
| Discovery::File and Directory Discovery (E1083) | Mebromi gets a file size. [2] |
| Discovery::System Information Discovery (E1082) | Mebromi checks OS version. [2] |
| Execution::Command and Scripting Interpreter (E1059) | Mebromi accepts command line arguments. [2] |
MBC Behaviors
| Name | Use |
|---|---|
| Execution::Conditional Execution (B0025) | Malware only proceeds if it detects the BIOS ROM is Award BIOS. [1] |
| Execution::Install Additional Program (B0023) | Malware contains a dropper that installs additional programs like Cbrom.exe. [1] |
| Data::Encode Data::XOR (C0026.002) | Mebromi encodes data using XOR. [2] |
| File System::Copy File (C0045) | Mebromi copies files. [2] |
| File System::Delete File (C0047) | Mebromi deletes files. [2] |
| File System::Move File (C0063) | Mebromi moves files. [2] |
| File System::Read File (C0051) | Mebromi reads files on Windows. [2] |
| Memory::Allocate Memory (C0007) | Mebromi allocates RWX memory. [2] |
| Process::Create Process (C0017) | Mebromi creates a process on Windows. [2] |
Indicators of Compromise
SHA256 Hashes
- 4968ae59a46b60c290cf5db8b3d6749df06ceb4be668009a609e1139fe91a9ee
- 8802ad7f2d267b754afef8fd81fe8e5f0ecc13e7f69b82e89e980922d94291ba
References
[1] https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
[2] capa v4.0, analyzed at MITRE on 10/12/2022