d2a55cb45e37fa6005674a4b73cf0f58bf987cefd2b5aaea2f39d76fc0c22f1c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d2a55cb45e37fa6005674a4b73cf0f58bf987cefd2b5aaea2f39d76fc0c22f1c
Size

624KB
Sample

221127-l9tnradc9t
MD5

62a48b0d4a9ef658bf2215e7c2422bd4
SHA1

aa5b53d1786f2f05b70fe0f99a9765bbdc120296
SHA256

d2a55cb45e37fa6005674a4b73cf0f58bf987cefd2b5aaea2f39d76fc0c22f1c
SHA512

72a95a364b27a22c4525a432a2ca011b43568070c59939fc91c343e75732a88290bd8e7b7044c0fff134e91d81cefce639e3a038b68da978515314c5816563c2
SSDEEP

12288:p93rW92itxpUGx1I/mCEUaQ9b0WF+cf6vDbRI4LBvhRybnlf61Y+H:3W92kUGx/s9bSvDbRlJ0bn81Y+H

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  d2a55cb45e37fa6005674a4b73cf0f58bf987cefd2b5aaea2f39d76fc0c22f1c
- Size
  
  624KB
- MD5
  
  62a48b0d4a9ef658bf2215e7c2422bd4
- SHA1
  
  aa5b53d1786f2f05b70fe0f99a9765bbdc120296
- SHA256
  
  d2a55cb45e37fa6005674a4b73cf0f58bf987cefd2b5aaea2f39d76fc0c22f1c
- SHA512
  
  72a95a364b27a22c4525a432a2ca011b43568070c59939fc91c343e75732a88290bd8e7b7044c0fff134e91d81cefce639e3a038b68da978515314c5816563c2
- SSDEEP
  
  12288:p93rW92itxpUGx1I/mCEUaQ9b0WF+cf6vDbRI4LBvhRybnlf61Y+H:3W92kUGx/s9bSvDbRlJ0bn81Y+H
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2