f9d11d7d977ef095267daeefc92101111902ccb1ad95817cb2de446ab920a75e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f9d11d7d977ef095267daeefc92101111902ccb1ad95817cb2de446ab920a75e
Size

15KB
Sample

221002-nwlr4afafm
MD5

6b7681528d1ecac9bc7cc71aaa2449e0
SHA1

28eec1014fb4254092e77f30102657b584d5d52d
SHA256

f9d11d7d977ef095267daeefc92101111902ccb1ad95817cb2de446ab920a75e
SHA512

b6a7c69aa1b74e1c7bba4099bf72c8a9c8d1a5b13d24b174e4beeacc43eebf6a9262152724ad73fcf1063dfc833a5ec1dc51453763ece4aa8b7914961d313316
SSDEEP

192:SVb3RV163B7vHtJUhctVoY5XBZeAf7AlC+R/:UP2U4oY5XBZe0AC+J

Score

8^/10

discovery

Malware Config

Targets

- Target
  
  f9d11d7d977ef095267daeefc92101111902ccb1ad95817cb2de446ab920a75e
- Size
  
  15KB
- MD5
  
  6b7681528d1ecac9bc7cc71aaa2449e0
- SHA1
  
  28eec1014fb4254092e77f30102657b584d5d52d
- SHA256
  
  f9d11d7d977ef095267daeefc92101111902ccb1ad95817cb2de446ab920a75e
- SHA512
  
  b6a7c69aa1b74e1c7bba4099bf72c8a9c8d1a5b13d24b174e4beeacc43eebf6a9262152724ad73fcf1063dfc833a5ec1dc51453763ece4aa8b7914961d313316
- SSDEEP
  
  192:SVb3RV163B7vHtJUhctVoY5XBZeAf7AlC+R/:UP2U4oY5XBZe0AC+J
Score

8^/10

discovery
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2