2d31b641508b195873f092d1dc4ae00b4660882549f0a2e484c863495845039d | Triage

Sharing

General

Target

2d31b641508b195873f092d1dc4ae00b4660882549f0a2e484c863495845039d
Size

98KB
Sample

221123-m4mhxsah7z
MD5

c47084affdc6747ac556343024a6148d
SHA1

90ac3dbc690723e92f77baf14db5e5729f794852
SHA256

2d31b641508b195873f092d1dc4ae00b4660882549f0a2e484c863495845039d
SHA512

f1002e26f84e7d3f53966772478e9bd3792b36ac6d631e04e4ef9fe58b040fd566f88f107aac5477c9c0c7d5e5d30a35e164fc988c2fcd5b94ad5e8e4f0720fa
SSDEEP

1536:9QxqcQu0XPmEmEcYUpEjCTfaAIW1EvqTlrxtPpFAXF9N/6Sy:y/03mEcppEjCTfaAIWSqTlrbPLEz4

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  2d31b641508b195873f092d1dc4ae00b4660882549f0a2e484c863495845039d
- Size
  
  98KB
- MD5
  
  c47084affdc6747ac556343024a6148d
- SHA1
  
  90ac3dbc690723e92f77baf14db5e5729f794852
- SHA256
  
  2d31b641508b195873f092d1dc4ae00b4660882549f0a2e484c863495845039d
- SHA512
  
  f1002e26f84e7d3f53966772478e9bd3792b36ac6d631e04e4ef9fe58b040fd566f88f107aac5477c9c0c7d5e5d30a35e164fc988c2fcd5b94ad5e8e4f0720fa
- SSDEEP
  
  1536:9QxqcQu0XPmEmEcYUpEjCTfaAIW1EvqTlrxtPpFAXF9N/6Sy:y/03mEcppEjCTfaAIWSqTlrbPLEz4
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2