95395280c54d83cae46f592f949737832ae0e63061963b6a9d5f8601050624ba | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95395280c54d83cae46f592f949737832ae0e63061963b6a9d5f8601050624ba
Size

74KB
Sample

221106-nh98jahch9
MD5

a04f49f58b2bb0f741635de1de7aebbb
SHA1

cbb859bce484e4a6c649546347213e91a9c6c3b1
SHA256

95395280c54d83cae46f592f949737832ae0e63061963b6a9d5f8601050624ba
SHA512

ff57a2e82633f039865b5d9f59ec30b16c47c87329c5901e8a6b2e716a0eb982882ac0208b9adffd3e5f3ec26da2d8117dcdaed8cfc807a6e38cc0334982633e
SSDEEP

1536:xcnpe2bYHgEsiDJNimbbrwbbbGbb6bbbbxNimbbrwbbbGbb6bbbb:Cnk2bYAGfw

Score

8^/10

Malware Config

Targets

- Target
  
  95395280c54d83cae46f592f949737832ae0e63061963b6a9d5f8601050624ba
- Size
  
  74KB
- MD5
  
  a04f49f58b2bb0f741635de1de7aebbb
- SHA1
  
  cbb859bce484e4a6c649546347213e91a9c6c3b1
- SHA256
  
  95395280c54d83cae46f592f949737832ae0e63061963b6a9d5f8601050624ba
- SHA512
  
  ff57a2e82633f039865b5d9f59ec30b16c47c87329c5901e8a6b2e716a0eb982882ac0208b9adffd3e5f3ec26da2d8117dcdaed8cfc807a6e38cc0334982633e
- SSDEEP
  
  1536:xcnpe2bYHgEsiDJNimbbrwbbbGbb6bbbbxNimbbrwbbbGbb6bbbb:Cnk2bYAGfw
Score

8^/10
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2