0494d6daa75b06c3f3286ec65b4347f94b5558f2be88632432a153f72ff6c320 | Triage

Sharing

General

Target

0494d6daa75b06c3f3286ec65b4347f94b5558f2be88632432a153f72ff6c320
Size

99KB
Sample

221202-3msavaaa2x
MD5

1d5fcfe23b5e91b8db4a7316a381afc0
SHA1

35fff00fbcec5be5c7f7cc41639c51fd933004b6
SHA256

0494d6daa75b06c3f3286ec65b4347f94b5558f2be88632432a153f72ff6c320
SHA512

9ac490af85c3911627847d0ef7a2b668ce7668173e2a3433d887c355cfcade3563fde9a96987c597c9ae014530e5c18b2858a52711f03565309dfa489a704329
SSDEEP

1536:9QxqcQu0XPmEmEcYUpEjCTfaAIW1EvqTlrxtPpFAXF9N/6Sy:y/03mEcppEjCTfaAIWSqTlrbPLEz4

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  0494d6daa75b06c3f3286ec65b4347f94b5558f2be88632432a153f72ff6c320
- Size
  
  99KB
- MD5
  
  1d5fcfe23b5e91b8db4a7316a381afc0
- SHA1
  
  35fff00fbcec5be5c7f7cc41639c51fd933004b6
- SHA256
  
  0494d6daa75b06c3f3286ec65b4347f94b5558f2be88632432a153f72ff6c320
- SHA512
  
  9ac490af85c3911627847d0ef7a2b668ce7668173e2a3433d887c355cfcade3563fde9a96987c597c9ae014530e5c18b2858a52711f03565309dfa489a704329
- SSDEEP
  
  1536:9QxqcQu0XPmEmEcYUpEjCTfaAIW1EvqTlrxtPpFAXF9N/6Sy:y/03mEcppEjCTfaAIWSqTlrbPLEz4
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2