2e6d71ea5a964e35203aa41a739fd9b4a1fa1008095f10b4f9094423f2604e65 | Triage

Sharing

General

Target

2e6d71ea5a964e35203aa41a739fd9b4a1fa1008095f10b4f9094423f2604e65
Size

685KB
Sample

221127-p94qhahh52
MD5

c3955e1a939254d0baba61e7b2975653
SHA1

1b5a5cb1f4eb10776d7ee8ca766e420cd6fa6c57
SHA256

2e6d71ea5a964e35203aa41a739fd9b4a1fa1008095f10b4f9094423f2604e65
SHA512

94a22ed7884399306a3ae64dc111295511b8fbcf35433c9bb065dbe9057dbb5fd2371cbd0584662d24031215b719eb19d1f2b3e8efcf0d0e4a7c8242ee2d6875
SSDEEP

12288:RtUBGy8Xz0MqcPHDc2YpKSouCsBvplyt1E5Mx8QVfqlrI+SyjDyD0lRWbk7SZ:UBaXz0MqcPHDc2YpKSo1sBh8t1E5MxZ/

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  2e6d71ea5a964e35203aa41a739fd9b4a1fa1008095f10b4f9094423f2604e65
- Size
  
  685KB
- MD5
  
  c3955e1a939254d0baba61e7b2975653
- SHA1
  
  1b5a5cb1f4eb10776d7ee8ca766e420cd6fa6c57
- SHA256
  
  2e6d71ea5a964e35203aa41a739fd9b4a1fa1008095f10b4f9094423f2604e65
- SHA512
  
  94a22ed7884399306a3ae64dc111295511b8fbcf35433c9bb065dbe9057dbb5fd2371cbd0584662d24031215b719eb19d1f2b3e8efcf0d0e4a7c8242ee2d6875
- SSDEEP
  
  12288:RtUBGy8Xz0MqcPHDc2YpKSouCsBvplyt1E5Mx8QVfqlrI+SyjDyD0lRWbk7SZ:UBaXz0MqcPHDc2YpKSo1sBh8t1E5MxZ/
Score

8^/10

discovery persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence