1c5c37f0c8f143c7eb7915ebf66430f6d95a470efc473b2f5ad002a95ede97bd | Triage

Sharing

General

Target

1c5c37f0c8f143c7eb7915ebf66430f6d95a470efc473b2f5ad002a95ede97bd
Size

320KB
Sample

221029-2ys6vaagc7
MD5

83daa6b903ab26aa5432fa95818a3592
SHA1

30b5401eab8142c42041d19b3447c73d0b432a70
SHA256

1c5c37f0c8f143c7eb7915ebf66430f6d95a470efc473b2f5ad002a95ede97bd
SHA512

dba5c4ec7a59f670428b806052e9945719d13ab34423733ac29e1d58b100b015519456e84e43876a21110b3fec48a42ee8db745f1d3a8e2633cde4976e08cb35
SSDEEP

6144:sIyEr1fTcAYfph1u79Ize0ZPi92PnJhU8oCacVE9GWW3Ze8Y6:sIneRh2Gz5ZPi9WnxacVE87t

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  1c5c37f0c8f143c7eb7915ebf66430f6d95a470efc473b2f5ad002a95ede97bd
- Size
  
  320KB
- MD5
  
  83daa6b903ab26aa5432fa95818a3592
- SHA1
  
  30b5401eab8142c42041d19b3447c73d0b432a70
- SHA256
  
  1c5c37f0c8f143c7eb7915ebf66430f6d95a470efc473b2f5ad002a95ede97bd
- SHA512
  
  dba5c4ec7a59f670428b806052e9945719d13ab34423733ac29e1d58b100b015519456e84e43876a21110b3fec48a42ee8db745f1d3a8e2633cde4976e08cb35
- SSDEEP
  
  6144:sIyEr1fTcAYfph1u79Ize0ZPi92PnJhU8oCacVE9GWW3Ze8Y6:sIneRh2Gz5ZPi9WnxacVE87t
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2