218fd88a08eb59ba0311b185aeabb84556f4d83ee5fde11a1c1ce6c7291692f4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

218fd88a08eb59ba0311b185aeabb84556f4d83ee5fde11a1c1ce6c7291692f4
Size

39KB
Sample

221003-nycbfaecen
MD5

6a33e38247f64da66a6c106fc7b54d20
SHA1

9239278a99b6ba06fd28a8c82e087558fc1de3c8
SHA256

218fd88a08eb59ba0311b185aeabb84556f4d83ee5fde11a1c1ce6c7291692f4
SHA512

afa460e2e56dd8912cad55ff9b8db2be093e9db3911fd7114f5a0f93956a5940e8ec8261fc41a7fc1e7a41377c54add272bb330c94260830c20fd09db99b556c
SSDEEP

768:heKEbmI5T5XhbNIB/S2YFpCwt6dYaxcQ7EgvjgBNyGp/Kd/GnRhRl7AiKEM:w5mWT5XbSOCERFKEM

Score

8^/10

evasion

Malware Config

Targets

- Target
  
  218fd88a08eb59ba0311b185aeabb84556f4d83ee5fde11a1c1ce6c7291692f4
- Size
  
  39KB
- MD5
  
  6a33e38247f64da66a6c106fc7b54d20
- SHA1
  
  9239278a99b6ba06fd28a8c82e087558fc1de3c8
- SHA256
  
  218fd88a08eb59ba0311b185aeabb84556f4d83ee5fde11a1c1ce6c7291692f4
- SHA512
  
  afa460e2e56dd8912cad55ff9b8db2be093e9db3911fd7114f5a0f93956a5940e8ec8261fc41a7fc1e7a41377c54add272bb330c94260830c20fd09db99b556c
- SSDEEP
  
  768:heKEbmI5T5XhbNIB/S2YFpCwt6dYaxcQ7EgvjgBNyGp/Kd/GnRhRl7AiKEM:w5mWT5XbSOCERFKEM
Score

8^/10

evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

behavioral2