f73ae2f99b0e949d2b2c9f5da598997a88eaf7c4121eea84a646de135fea8d43 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f73ae2f99b0e949d2b2c9f5da598997a88eaf7c4121eea84a646de135fea8d43
Size

476KB
Sample

221107-cbsjcseefj
MD5

0e66105b729b8ebbb47e15e3998900d8
SHA1

4c0bb38320d7f876ec499be5e7e75aa4096d65bc
SHA256

f73ae2f99b0e949d2b2c9f5da598997a88eaf7c4121eea84a646de135fea8d43
SHA512

9060ebe4219d7a49b838eb6d1d481117e287d16542ecf45f72caaaa7d288089fc851ec8cc9e83169c50882c450a6d71e9ca7730b648773b2453ef9ca3df2408b
SSDEEP

6144:oZSJF1utNnaF2idZecnl20lHRxp3glTlDZLkv0OFHMAQowOGtQt58luPBMsH9kT:oZSJva4F3Z4mxxUJ9oZHMdoJGtQDTJh

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  f73ae2f99b0e949d2b2c9f5da598997a88eaf7c4121eea84a646de135fea8d43
- Size
  
  476KB
- MD5
  
  0e66105b729b8ebbb47e15e3998900d8
- SHA1
  
  4c0bb38320d7f876ec499be5e7e75aa4096d65bc
- SHA256
  
  f73ae2f99b0e949d2b2c9f5da598997a88eaf7c4121eea84a646de135fea8d43
- SHA512
  
  9060ebe4219d7a49b838eb6d1d481117e287d16542ecf45f72caaaa7d288089fc851ec8cc9e83169c50882c450a6d71e9ca7730b648773b2453ef9ca3df2408b
- SSDEEP
  
  6144:oZSJF1utNnaF2idZecnl20lHRxp3glTlDZLkv0OFHMAQowOGtQt58luPBMsH9kT:oZSJva4F3Z4mxxUJ9oZHMdoJGtQDTJh
Score

8^/10

persistence
- Executes dropped EXE
- Sets DLL path for service in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2