982771c03b24a060549712a487f9d8f0d850fd35cc8a0578c79f1ba05c5793e8 | Triage

Sharing

General

Target

982771c03b24a060549712a487f9d8f0d850fd35cc8a0578c79f1ba05c5793e8
Size

338KB
Sample

221011-r5qzysach8
MD5

1a6e98a94b85f52007fd959f6b8bc110
SHA1

f3bdccb0d1a136cef5af28d95b3b378fb8e204ed
SHA256

982771c03b24a060549712a487f9d8f0d850fd35cc8a0578c79f1ba05c5793e8
SHA512

1c2301bf20e4c730324aec545b2aab9eb6001ffd1da89ccf211a590eee5a51afc5dc82cd78709c71e7fddd53730dba4bb538478369058dcb58c4325b63c61d26
SSDEEP

6144:i4V7nL2adqmpbSwQYpdE9nOYrGFigjeMpMwpmCezgpHreXFI8:i4V7nL2a9pR109n7rOiupu3zgt8a8

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  982771c03b24a060549712a487f9d8f0d850fd35cc8a0578c79f1ba05c5793e8
- Size
  
  338KB
- MD5
  
  1a6e98a94b85f52007fd959f6b8bc110
- SHA1
  
  f3bdccb0d1a136cef5af28d95b3b378fb8e204ed
- SHA256
  
  982771c03b24a060549712a487f9d8f0d850fd35cc8a0578c79f1ba05c5793e8
- SHA512
  
  1c2301bf20e4c730324aec545b2aab9eb6001ffd1da89ccf211a590eee5a51afc5dc82cd78709c71e7fddd53730dba4bb538478369058dcb58c4325b63c61d26
- SSDEEP
  
  6144:i4V7nL2adqmpbSwQYpdE9nOYrGFigjeMpMwpmCezgpHreXFI8:i4V7nL2a9pR109n7rOiupu3zgt8a8
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2