aad738c274d2a49c68551dda7de5598c96ffd258552aa6a0f0170c65979bfcc9 | Triage

Sharing

General

Target

aad738c274d2a49c68551dda7de5598c96ffd258552aa6a0f0170c65979bfcc9
Size

925KB
Sample

221003-yrwrlsdefj
MD5

5476302330eae3f1a596d60e98b98ccf
SHA1

65afc6c843de2984c94319421f5ac776d0b268e1
SHA256

aad738c274d2a49c68551dda7de5598c96ffd258552aa6a0f0170c65979bfcc9
SHA512

132b164566a80888a49d6ba5fe71ac2aed7ba877192eab117b1b95cedeacf1f47bd8dbd9f1b0578f1af34823d8cdf4851dc89609884eb73d65f10b65a43da276
SSDEEP

6144:a+nglw9ayQv3ahvyn/PU7O0KXgTTSjyEN2ERBOzlSmGWsYs5+jtGvA4qSi5A9/HW:rjS3Yvyn/0TvSmqN5944qSjNHtJ44q4I

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  aad738c274d2a49c68551dda7de5598c96ffd258552aa6a0f0170c65979bfcc9
- Size
  
  925KB
- MD5
  
  5476302330eae3f1a596d60e98b98ccf
- SHA1
  
  65afc6c843de2984c94319421f5ac776d0b268e1
- SHA256
  
  aad738c274d2a49c68551dda7de5598c96ffd258552aa6a0f0170c65979bfcc9
- SHA512
  
  132b164566a80888a49d6ba5fe71ac2aed7ba877192eab117b1b95cedeacf1f47bd8dbd9f1b0578f1af34823d8cdf4851dc89609884eb73d65f10b65a43da276
- SSDEEP
  
  6144:a+nglw9ayQv3ahvyn/PU7O0KXgTTSjyEN2ERBOzlSmGWsYs5+jtGvA4qSi5A9/HW:rjS3Yvyn/0TvSmqN5944qSjNHtJ44q4I
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2