General

  • Target

    tmp

  • Size

    9.5MB

  • Sample

    220923-hhlmaaddd5

  • MD5

    5b0c800dc0a9318659ce511d96f83e31

  • SHA1

    666709ec97b6742b5bdc4b425333a14ac383f12e

  • SHA256

    9aabdf426620b16358bb48ce7ef0f92e5343715f78e4a35d8733beff57ca497d

  • SHA512

    acb1a644100a59a68348ba6e45e98bf5d3e8021573ddef2148a923c31fe6ba218b3cfe8b86db9c48d89ad0bd92c9bb4be5b837bdbd0f9710e5e39696c39a0a45

  • SSDEEP

    196608:tLSbvETcxNk4BMWT+4iBjMfj5WMinMqIDoYUR8QPPQGoZPIe625DL7RaorV:tspepc0BjMLZinMqejE3eFIxwL9aoJ

Malware Config

Targets

    • Target

      tmp

    • Size

      9.5MB

    • MD5

      5b0c800dc0a9318659ce511d96f83e31

    • SHA1

      666709ec97b6742b5bdc4b425333a14ac383f12e

    • SHA256

      9aabdf426620b16358bb48ce7ef0f92e5343715f78e4a35d8733beff57ca497d

    • SHA512

      acb1a644100a59a68348ba6e45e98bf5d3e8021573ddef2148a923c31fe6ba218b3cfe8b86db9c48d89ad0bd92c9bb4be5b837bdbd0f9710e5e39696c39a0a45

    • SSDEEP

      196608:tLSbvETcxNk4BMWT+4iBjMfj5WMinMqIDoYUR8QPPQGoZPIe625DL7RaorV:tspepc0BjMLZinMqejE3eFIxwL9aoJ

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Tasks