c2ad5092c0e3b1a70b4154f0c98dad02d5b2687b98712699fc82e21761147af9 | Triage

Sharing

General

Target

c2ad5092c0e3b1a70b4154f0c98dad02d5b2687b98712699fc82e21761147af9
Size

512KB
Sample

221128-hwl5zaab5s
MD5

f3f0adfa494830b60816168a486ff669
SHA1

6a999e43d487b53f4c737abd13ea0d6ebc5f1acb
SHA256

c2ad5092c0e3b1a70b4154f0c98dad02d5b2687b98712699fc82e21761147af9
SHA512

ba5a3aee33175b640c282a4f659c3675c1b9034f441ff4eae1e1afe65e1ae4958e62e2801071db005d96aae365ac71cfcbba797da4a47fd861fe33256ac8f285
SSDEEP

12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4J:0+h9OY70z+warul3E4J

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  c2ad5092c0e3b1a70b4154f0c98dad02d5b2687b98712699fc82e21761147af9
- Size
  
  512KB
- MD5
  
  f3f0adfa494830b60816168a486ff669
- SHA1
  
  6a999e43d487b53f4c737abd13ea0d6ebc5f1acb
- SHA256
  
  c2ad5092c0e3b1a70b4154f0c98dad02d5b2687b98712699fc82e21761147af9
- SHA512
  
  ba5a3aee33175b640c282a4f659c3675c1b9034f441ff4eae1e1afe65e1ae4958e62e2801071db005d96aae365ac71cfcbba797da4a47fd861fe33256ac8f285
- SSDEEP
  
  12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4J:0+h9OY70z+warul3E4J
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2