819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191 | Triage

Sharing

General

Target

819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191
Size

127KB
Sample

221019-qb91asghh3
MD5

a18ba014aa88c7380e2933e3462c6aeb
SHA1

88a96c094935b1a75929cdf8fc8f80aa7923a373
SHA256

819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191
SHA512

1b6c3ebd6f930de59fff89eda07935ea5b0202709c5eb0dd90c6b8eaabcf68d07788e6ab988bb73d4aa0fbee64fd937070ce4dc4ea9fb0cfb9a21f33281139fa
SSDEEP

3072:fTZtv4Ymgik7lC7rD4X1HYWB7MCSswGAPSliBAbUcI5tsRDk:VVSgdC7rD4JKCSDGS+T2tsRDk

Score

8^/10

Malware Config

Targets

- Target
  
  819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191
- Size
  
  127KB
- MD5
  
  a18ba014aa88c7380e2933e3462c6aeb
- SHA1
  
  88a96c094935b1a75929cdf8fc8f80aa7923a373
- SHA256
  
  819718db756ad5550a9c88b12f61606a2ccc780f6f431fef378f5bae8eba7191
- SHA512
  
  1b6c3ebd6f930de59fff89eda07935ea5b0202709c5eb0dd90c6b8eaabcf68d07788e6ab988bb73d4aa0fbee64fd937070ce4dc4ea9fb0cfb9a21f33281139fa
- SSDEEP
  
  3072:fTZtv4Ymgik7lC7rD4X1HYWB7MCSswGAPSliBAbUcI5tsRDk:VVSgdC7rD4JKCSDGS+T2tsRDk
Score

8^/10
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2