dba8254d0121568eadb1d2bd42d28d888d1a8a1970ad8e687cf8e32ce928ab66 | Triage

Sharing

General

Target

dba8254d0121568eadb1d2bd42d28d888d1a8a1970ad8e687cf8e32ce928ab66
Size

86KB
Sample

221203-b9373sgh4s
MD5

35c4b5727d1e0bb1db369e3aa03b9348
SHA1

4e3e37efa8925bb92081ec3bc052facd17d1e8f9
SHA256

dba8254d0121568eadb1d2bd42d28d888d1a8a1970ad8e687cf8e32ce928ab66
SHA512

eb237b69d926a708aade934e4a71a9291c5aa79088f912f0753b8e17b88b3fbf7636de6fedde9e87bc27bc238fac4663716550a2bb1244ba6ffa6285b7dcb95f
SSDEEP

1536:HlfbwimgTY23tG90wIsWfHlWKSd+QSqWU5FdCmCWuKw6kS+AJtBcg9HGULnQxYy5:Hl0img13tG90HdQ3SqtRjCT7fmJtBfQr

Score

8^/10

Malware Config

Targets

- Target
  
  GOLAYA-PHOTO.exe
- Size
  
  181KB
- MD5
  
  3f0da76b4c682e86aeb9a8a425eaa903
- SHA1
  
  650b36332381beac233426a3fb4bfeaca92a1296
- SHA256
  
  ffa647bd5ec34f2f982bd2695abf1be734d323b66617c9e7f8bdaed49832ec6e
- SHA512
  
  29010590d712e329c322430340c3cd28c88d7242fefebe0f404c04f7eb703351b27c5faf01771259bb768c1ed7d14cf1730f626a372754d6579b91656bdc4c92
- SSDEEP
  
  3072:YBAp5XhKpN4eOyVTGfhEClj8jTk+0hD+iG+v5y1rF0t8:PbXE9OiTGfhEClq9iktFb
Score

8^/10
- Blocklisted process makes network request
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2