b1be238db2f72bdbac20975b9c6136d2c3fd518fa09765362e6e4cfb12b5b17f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b1be238db2f72bdbac20975b9c6136d2c3fd518fa09765362e6e4cfb12b5b17f
Size

401KB
Sample

221019-3ykp5sdgc6
MD5

916f04e90f930d9f7b5ea2ec6145e440
SHA1

5477c5492d47969e5024c5ea77091a15256ea1ed
SHA256

b1be238db2f72bdbac20975b9c6136d2c3fd518fa09765362e6e4cfb12b5b17f
SHA512

595773ca9e3b9adf1193b839e8bf47a01122745aa8208a6b458ac7f2783f879f09d63fb1e0046325c0a1323b167d4cc8a99035080a51c1e2ee8e6e531fffba56
SSDEEP

768:2bAhl9WJTlV4+RiHdxOnW5MedsruJDWaS77BKbwexZw32SLg0innjhyVT8Jr:PlUP2WW5MeGD7BKb7+it2wd

Score

8^/10

Malware Config

Targets

- Target
  
  b1be238db2f72bdbac20975b9c6136d2c3fd518fa09765362e6e4cfb12b5b17f
- Size
  
  401KB
- MD5
  
  916f04e90f930d9f7b5ea2ec6145e440
- SHA1
  
  5477c5492d47969e5024c5ea77091a15256ea1ed
- SHA256
  
  b1be238db2f72bdbac20975b9c6136d2c3fd518fa09765362e6e4cfb12b5b17f
- SHA512
  
  595773ca9e3b9adf1193b839e8bf47a01122745aa8208a6b458ac7f2783f879f09d63fb1e0046325c0a1323b167d4cc8a99035080a51c1e2ee8e6e531fffba56
- SSDEEP
  
  768:2bAhl9WJTlV4+RiHdxOnW5MedsruJDWaS77BKbwexZw32SLg0innjhyVT8Jr:PlUP2WW5MeGD7BKb7+it2wd
Score

8^/10
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2