9e2a97ae4bfe5e656f83168bd905f2060697f857fc925008221de8f20ed76d1c | Triage

Sharing

General

Target

9e2a97ae4bfe5e656f83168bd905f2060697f857fc925008221de8f20ed76d1c
Size

356KB
Sample

220919-pcqglscacm
MD5

9c53f489e43b43601ec9d312950b4e84
SHA1

1d4fb40c4e2b772ef0a72e4bc98cd7c6d6d6c91f
SHA256

9e2a97ae4bfe5e656f83168bd905f2060697f857fc925008221de8f20ed76d1c
SHA512

b260aa6f70ca99c1d409f7a8f571b7e7540eee808004e3bff84ad1765da7349b43bfa48235da314464618e2b6824d6f167c03035e237527d1d1828c8645bf5af
SSDEEP

6144:HW89Ehpl3/B/ZkBM6xRSWSurUtGUaImiR0K/CSosTb3iSRO:HWUsphBKM6r1xUtgIm+eSoms

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  9e2a97ae4bfe5e656f83168bd905f2060697f857fc925008221de8f20ed76d1c
- Size
  
  356KB
- MD5
  
  9c53f489e43b43601ec9d312950b4e84
- SHA1
  
  1d4fb40c4e2b772ef0a72e4bc98cd7c6d6d6c91f
- SHA256
  
  9e2a97ae4bfe5e656f83168bd905f2060697f857fc925008221de8f20ed76d1c
- SHA512
  
  b260aa6f70ca99c1d409f7a8f571b7e7540eee808004e3bff84ad1765da7349b43bfa48235da314464618e2b6824d6f167c03035e237527d1d1828c8645bf5af
- SSDEEP
  
  6144:HW89Ehpl3/B/ZkBM6xRSWSurUtGUaImiR0K/CSosTb3iSRO:HWUsphBKM6r1xUtgIm+eSoms
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2