312dc64ddf1f9b7dd57dd1f7c9bb68e47f094d5babe1edea60f0ecebf1af1159 | Triage

Sharing

General

Target

312dc64ddf1f9b7dd57dd1f7c9bb68e47f094d5babe1edea60f0ecebf1af1159
Size

276KB
Sample

221124-jlgyyahe84
MD5

1472d2c071f3910d0903031bfa2caa6f
SHA1

aec323f98975dd67ea19abe7bb326b68383f7a53
SHA256

312dc64ddf1f9b7dd57dd1f7c9bb68e47f094d5babe1edea60f0ecebf1af1159
SHA512

98983a99e28d02816a4b37260752ef45a745af9b582a8b8e84d7921f22e7d51630a8bb4212ff642f39b6295d878c5122237d1507e2c5561299033380351f96c2
SSDEEP

3072:F2bJpL5h2uohvgCGjNfz6MP8jkxpYu0LITAvjgFSirJsTV8Y67ETzR4Wigb5jAbR:FeL5h5WfGhfuMEPpITS8tJOWETCWigb

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  312dc64ddf1f9b7dd57dd1f7c9bb68e47f094d5babe1edea60f0ecebf1af1159
- Size
  
  276KB
- MD5
  
  1472d2c071f3910d0903031bfa2caa6f
- SHA1
  
  aec323f98975dd67ea19abe7bb326b68383f7a53
- SHA256
  
  312dc64ddf1f9b7dd57dd1f7c9bb68e47f094d5babe1edea60f0ecebf1af1159
- SHA512
  
  98983a99e28d02816a4b37260752ef45a745af9b582a8b8e84d7921f22e7d51630a8bb4212ff642f39b6295d878c5122237d1507e2c5561299033380351f96c2
- SSDEEP
  
  3072:F2bJpL5h2uohvgCGjNfz6MP8jkxpYu0LITAvjgFSirJsTV8Y67ETzR4Wigb5jAbR:FeL5h5WfGhfuMEPpITS8tJOWETCWigb
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2