ee62b940da02e17824bc8aef4912b96eeb0999d38445aa0053bc7c2a002a4013 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ee62b940da02e17824bc8aef4912b96eeb0999d38445aa0053bc7c2a002a4013
Size

1.7MB
Sample

221203-brm35scf55
MD5

10e17b3c555889d8ea29274e0fca9054
SHA1

f74ea1cd763a8e84cc2b691dbf02a87b8d06d818
SHA256

ee62b940da02e17824bc8aef4912b96eeb0999d38445aa0053bc7c2a002a4013
SHA512

804b4ad540be593972c62a7b1df792df3951634815a89c2227f6338d248c437ee60d75f58a59eaf47f51653ec69b339be4e14e7d0752948de145e17be4ba5c37
SSDEEP

24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNJ:mbTChxKCnFnQXBbrtgb/iQvu0UHO+

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  ee62b940da02e17824bc8aef4912b96eeb0999d38445aa0053bc7c2a002a4013
- Size
  
  1.7MB
- MD5
  
  10e17b3c555889d8ea29274e0fca9054
- SHA1
  
  f74ea1cd763a8e84cc2b691dbf02a87b8d06d818
- SHA256
  
  ee62b940da02e17824bc8aef4912b96eeb0999d38445aa0053bc7c2a002a4013
- SHA512
  
  804b4ad540be593972c62a7b1df792df3951634815a89c2227f6338d248c437ee60d75f58a59eaf47f51653ec69b339be4e14e7d0752948de145e17be4ba5c37
- SSDEEP
  
  24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNJ:mbTChxKCnFnQXBbrtgb/iQvu0UHO+
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2