b56064564ca37d72a3f77fbdb1f372419e0a27e37610564d083a777628253a7f | Triage

Sharing

General

Target

b56064564ca37d72a3f77fbdb1f372419e0a27e37610564d083a777628253a7f
Size

512KB
Sample

221127-z2rfbahg45
MD5

d984cd39fd076046b3eb1334d49a7bee
SHA1

c718ac5ae486e3c53249c0aeae01ec4ff6e1def1
SHA256

b56064564ca37d72a3f77fbdb1f372419e0a27e37610564d083a777628253a7f
SHA512

689afe39353ebd527c639bad04cead1912a33c49c17b793bd3d9f6bfce410f42440d62e82c1af1d5fa131ca828c8a9fb81114c66bdd1863fdcd06069f094a565
SSDEEP

12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4n:0+h9OY70z+warul3E4n

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  b56064564ca37d72a3f77fbdb1f372419e0a27e37610564d083a777628253a7f
- Size
  
  512KB
- MD5
  
  d984cd39fd076046b3eb1334d49a7bee
- SHA1
  
  c718ac5ae486e3c53249c0aeae01ec4ff6e1def1
- SHA256
  
  b56064564ca37d72a3f77fbdb1f372419e0a27e37610564d083a777628253a7f
- SHA512
  
  689afe39353ebd527c639bad04cead1912a33c49c17b793bd3d9f6bfce410f42440d62e82c1af1d5fa131ca828c8a9fb81114c66bdd1863fdcd06069f094a565
- SSDEEP
  
  12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4n:0+h9OY70z+warul3E4n
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2