651c8614c07cd639cc4d05874e588d0f5b9a7117de0f629987feb30fb80d31f4 | Triage

Sharing

General

Target

651c8614c07cd639cc4d05874e588d0f5b9a7117de0f629987feb30fb80d31f4
Size

1.3MB
Sample

221123-k3eqksdd61
MD5

cf82aff8976755c0277e41f8950354ca
SHA1

cf9c0f4d64384f6138da908222a9317908b301db
SHA256

651c8614c07cd639cc4d05874e588d0f5b9a7117de0f629987feb30fb80d31f4
SHA512

77274e392e48918258268728eeaa8952bb1edec61840d872dd6d1f5107abb2fd74b2e0c7bc80ca50cfee858aec77b86772c226dce594d773d13fb85cf78116d2
SSDEEP

24576:T8sxWHNcswblwGVrpcxt0agedG5zkv1UOWqsu/mmO+SmDpQT6LEk6CGwvbw:T8Wucvjit0ardG5iUrDu/CXmW2QI90

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  651c8614c07cd639cc4d05874e588d0f5b9a7117de0f629987feb30fb80d31f4
- Size
  
  1.3MB
- MD5
  
  cf82aff8976755c0277e41f8950354ca
- SHA1
  
  cf9c0f4d64384f6138da908222a9317908b301db
- SHA256
  
  651c8614c07cd639cc4d05874e588d0f5b9a7117de0f629987feb30fb80d31f4
- SHA512
  
  77274e392e48918258268728eeaa8952bb1edec61840d872dd6d1f5107abb2fd74b2e0c7bc80ca50cfee858aec77b86772c226dce594d773d13fb85cf78116d2
- SSDEEP
  
  24576:T8sxWHNcswblwGVrpcxt0agedG5zkv1UOWqsu/mmO+SmDpQT6LEk6CGwvbw:T8Wucvjit0ardG5iUrDu/CXmW2QI90
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2