ed3364e6693051052b4043958fc76a02cfe25373ef413f555644c96e9bb99e8a | Triage

Sharing

General

Target

ed3364e6693051052b4043958fc76a02cfe25373ef413f555644c96e9bb99e8a
Size

286KB
Sample

221003-cs8a5scba2
MD5

6b8bfe79d4a708399947599b0058d73a
SHA1

b950a06a324b3fedd320deea7997670689f8ef91
SHA256

ed3364e6693051052b4043958fc76a02cfe25373ef413f555644c96e9bb99e8a
SHA512

f0d5f91b9d49d3d70de14d27f8cc41e2ead2f327bf76b800150da69a25285a3f6aa6ac95819b7994c7a5ac6c0fb62ee2dbc09d02eb5fa1407e5eacb7dbe01a9c
SSDEEP

3072:3S6t1ooarTRsA40fPDCsDq5bUEfpS96+/EjgWGMuv/S4p9KBI6+zzPyyRuvrp6o3:1ARsBWLnmf896vjgWGhSECIGyEvr53

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  ed3364e6693051052b4043958fc76a02cfe25373ef413f555644c96e9bb99e8a
- Size
  
  286KB
- MD5
  
  6b8bfe79d4a708399947599b0058d73a
- SHA1
  
  b950a06a324b3fedd320deea7997670689f8ef91
- SHA256
  
  ed3364e6693051052b4043958fc76a02cfe25373ef413f555644c96e9bb99e8a
- SHA512
  
  f0d5f91b9d49d3d70de14d27f8cc41e2ead2f327bf76b800150da69a25285a3f6aa6ac95819b7994c7a5ac6c0fb62ee2dbc09d02eb5fa1407e5eacb7dbe01a9c
- SSDEEP
  
  3072:3S6t1ooarTRsA40fPDCsDq5bUEfpS96+/EjgWGMuv/S4p9KBI6+zzPyyRuvrp6o3:1ARsBWLnmf896vjgWGhSECIGyEvr53
Score

8^/10

persistence
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2