0dcaf38551371f7b698ab4606b34e41f9a5b82f245838e7f9e53423fc85ab634 | Triage

Sharing

General

Target

0dcaf38551371f7b698ab4606b34e41f9a5b82f245838e7f9e53423fc85ab634
Size

343KB
Sample

221126-aqvadsce7y
MD5

d13f8cb8e80592f9104c550c342321c8
SHA1

b4201bbb276ec99b60f6e025029132160651e089
SHA256

0dcaf38551371f7b698ab4606b34e41f9a5b82f245838e7f9e53423fc85ab634
SHA512

366682dec6cf3da52bcb5435b7308ff3781679806994171470e2157d7edb93655818235373547ffa65f04a59499b633a7925f8e5b7c59e9fb0321c68c67cd548
SSDEEP

6144:EEDZkqQUrXAs4NCbomYfmwcyDFKbm8now9cdemJ56c0X4i:EEtk5UrXAsKmw7Kbm8WrJnAp

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  0dcaf38551371f7b698ab4606b34e41f9a5b82f245838e7f9e53423fc85ab634
- Size
  
  343KB
- MD5
  
  d13f8cb8e80592f9104c550c342321c8
- SHA1
  
  b4201bbb276ec99b60f6e025029132160651e089
- SHA256
  
  0dcaf38551371f7b698ab4606b34e41f9a5b82f245838e7f9e53423fc85ab634
- SHA512
  
  366682dec6cf3da52bcb5435b7308ff3781679806994171470e2157d7edb93655818235373547ffa65f04a59499b633a7925f8e5b7c59e9fb0321c68c67cd548
- SSDEEP
  
  6144:EEDZkqQUrXAs4NCbomYfmwcyDFKbm8now9cdemJ56c0X4i:EEtk5UrXAsKmw7Kbm8WrJnAp
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2