eb746dd9b537c85ecf9c3f4871bd6daf87849c53e54d85668b994a10423a37cc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eb746dd9b537c85ecf9c3f4871bd6daf87849c53e54d85668b994a10423a37cc
Size

512KB
Sample

221128-hh8f2sda43
MD5

2e6806e88d63fcad1cc4436b126bed9c
SHA1

c37d26b416e43f99784fd0c2dda4a0f9d0025eff
SHA256

eb746dd9b537c85ecf9c3f4871bd6daf87849c53e54d85668b994a10423a37cc
SHA512

9e94d1fff79faddd6247f3eeeba4b27f6bd501cf966b0e3bae966e35f5b3931b10c7262f2695bf137c773f0e09b74f8c8f1b69f4403905118edba5c77666b912
SSDEEP

12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E41:0+h9OY70z+warul3E41

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  eb746dd9b537c85ecf9c3f4871bd6daf87849c53e54d85668b994a10423a37cc
- Size
  
  512KB
- MD5
  
  2e6806e88d63fcad1cc4436b126bed9c
- SHA1
  
  c37d26b416e43f99784fd0c2dda4a0f9d0025eff
- SHA256
  
  eb746dd9b537c85ecf9c3f4871bd6daf87849c53e54d85668b994a10423a37cc
- SHA512
  
  9e94d1fff79faddd6247f3eeeba4b27f6bd501cf966b0e3bae966e35f5b3931b10c7262f2695bf137c773f0e09b74f8c8f1b69f4403905118edba5c77666b912
- SSDEEP
  
  12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E41:0+h9OY70z+warul3E41
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2