41b1c2059a331f3ae95f08d14026ea31624e200797c29d7b1146613f015b6296 | Triage

Sharing

General

Target

41b1c2059a331f3ae95f08d14026ea31624e200797c29d7b1146613f015b6296
Size

260KB
Sample

221123-xcezwahe71
MD5

15b394fa2a04924b6668589b4e4cf102
SHA1

ac0cf690fd4a13a0f27ad1954ac948243bbecc2d
SHA256

41b1c2059a331f3ae95f08d14026ea31624e200797c29d7b1146613f015b6296
SHA512

63ad113404b7247c5529a73013a3a1aab1a0e92f801f97363dccc18ae860ffe49f59d2759be39ebfe6a4349e147ad9d85026c9b315cc6d44574584e0b704f44c
SSDEEP

6144:L4V7nL2adqmpbSwQYpdE9nOYrGFig77ClSTnQF:L4V7nL2a9pR109n7rOi+kSrA

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  41b1c2059a331f3ae95f08d14026ea31624e200797c29d7b1146613f015b6296
- Size
  
  260KB
- MD5
  
  15b394fa2a04924b6668589b4e4cf102
- SHA1
  
  ac0cf690fd4a13a0f27ad1954ac948243bbecc2d
- SHA256
  
  41b1c2059a331f3ae95f08d14026ea31624e200797c29d7b1146613f015b6296
- SHA512
  
  63ad113404b7247c5529a73013a3a1aab1a0e92f801f97363dccc18ae860ffe49f59d2759be39ebfe6a4349e147ad9d85026c9b315cc6d44574584e0b704f44c
- SSDEEP
  
  6144:L4V7nL2adqmpbSwQYpdE9nOYrGFig77ClSTnQF:L4V7nL2a9pR109n7rOi+kSrA
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2