a9278d263852cc3c17c8bff3d69f400e6223d6de2698e89243cc30946a4be5c1 | Triage

Sharing

General

Target

a9278d263852cc3c17c8bff3d69f400e6223d6de2698e89243cc30946a4be5c1
Size

98KB
Sample

221106-fl4adsfham
MD5

3f89d99c1240af69375689d123916d10
SHA1

1ca2546306dd1b1bdb970b2b7ef3353b8b4e0281
SHA256

a9278d263852cc3c17c8bff3d69f400e6223d6de2698e89243cc30946a4be5c1
SHA512

e8f2d6432c44c52dcd2c8a787ae4eb5a9eeb74a9288afc65ca35fa2c954c2da4a2f18a4628a8ff3dd0c1d640db935e95583fb89aa7f04bbf9c6a9f8d20e4bd4d
SSDEEP

1536:9QxqcQu0XPmEmEcYUpEjCTfaAIW1EvqTlrxtPpFAXF9N/6Sy:y/03mEcppEjCTfaAIWSqTlrbPLEz4

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  a9278d263852cc3c17c8bff3d69f400e6223d6de2698e89243cc30946a4be5c1
- Size
  
  98KB
- MD5
  
  3f89d99c1240af69375689d123916d10
- SHA1
  
  1ca2546306dd1b1bdb970b2b7ef3353b8b4e0281
- SHA256
  
  a9278d263852cc3c17c8bff3d69f400e6223d6de2698e89243cc30946a4be5c1
- SHA512
  
  e8f2d6432c44c52dcd2c8a787ae4eb5a9eeb74a9288afc65ca35fa2c954c2da4a2f18a4628a8ff3dd0c1d640db935e95583fb89aa7f04bbf9c6a9f8d20e4bd4d
- SSDEEP
  
  1536:9QxqcQu0XPmEmEcYUpEjCTfaAIW1EvqTlrxtPpFAXF9N/6Sy:y/03mEcppEjCTfaAIWSqTlrbPLEz4
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2