4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69
Size

775KB
Sample

221011-2rwcmahhdk
MD5

4d1fb0eb9f401a7f43572197d12e29a0
SHA1

b4c0814f552fe5d88a249fdc808925c37cb19e0c
SHA256

4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69
SHA512

f584ab9c21734bfe25a559bb98ac048bf8b0ba910e59c186ff6c79825482a2b91a299afa65f409f2bb28440e26489123a4271cdc897bc91eab242e557fe04f3f
SSDEEP

12288:HXZKu9TygrJ9YQ1DNIZmzIbwUB/qsgIsqA:HXZJRimzIbwu/qsgI1A

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69
- Size
  
  775KB
- MD5
  
  4d1fb0eb9f401a7f43572197d12e29a0
- SHA1
  
  b4c0814f552fe5d88a249fdc808925c37cb19e0c
- SHA256
  
  4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69
- SHA512
  
  f584ab9c21734bfe25a559bb98ac048bf8b0ba910e59c186ff6c79825482a2b91a299afa65f409f2bb28440e26489123a4271cdc897bc91eab242e557fe04f3f
- SSDEEP
  
  12288:HXZKu9TygrJ9YQ1DNIZmzIbwUB/qsgIsqA:HXZJRimzIbwu/qsgI1A
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2