b6e4f89352611004e9f5cf1d57d10c04c1df3e32205d441db29b1167dd68c3d7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b6e4f89352611004e9f5cf1d57d10c04c1df3e32205d441db29b1167dd68c3d7
Size

63KB
Sample

221203-sakp5aae53
MD5

ca7e77da33c0ef992a615c2c616b0c9c
SHA1

b28dd70f9b0eab845b801726ab9895b50ac68619
SHA256

b6e4f89352611004e9f5cf1d57d10c04c1df3e32205d441db29b1167dd68c3d7
SHA512

bba0479ab5f7e5300fcb21a7a77a26b1879b62c4e49301bc3b50db58257e95c952ed4aea0d9e2532126cfe239e17147e02694b64519301dbc76ffa1d66985ba7
SSDEEP

1536:454CnhpZeFD4zEcqPD+/2u7mbV5UdH8cQD9++N5X:45LhSD4ziy/2jvUdH8T++N5X

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  b6e4f89352611004e9f5cf1d57d10c04c1df3e32205d441db29b1167dd68c3d7
- Size
  
  63KB
- MD5
  
  ca7e77da33c0ef992a615c2c616b0c9c
- SHA1
  
  b28dd70f9b0eab845b801726ab9895b50ac68619
- SHA256
  
  b6e4f89352611004e9f5cf1d57d10c04c1df3e32205d441db29b1167dd68c3d7
- SHA512
  
  bba0479ab5f7e5300fcb21a7a77a26b1879b62c4e49301bc3b50db58257e95c952ed4aea0d9e2532126cfe239e17147e02694b64519301dbc76ffa1d66985ba7
- SSDEEP
  
  1536:454CnhpZeFD4zEcqPD+/2u7mbV5UdH8cQD9++N5X:45LhSD4ziy/2jvUdH8T++N5X
Score

8^/10

persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2