b2265cf131901f3f2553023b29ececa0927ea71e283bb4976883045bd1b5a96e | Triage

Sharing

General

Target

b2265cf131901f3f2553023b29ececa0927ea71e283bb4976883045bd1b5a96e
Size

216KB
Sample

221203-y8cp3acf22
MD5

56e194f08625e669fe2adf839a2d3c3e
SHA1

f1a175648979ff62915cb7bbc9748ce35ac7ce34
SHA256

b2265cf131901f3f2553023b29ececa0927ea71e283bb4976883045bd1b5a96e
SHA512

05668c29424929494e6f611edc3761efd686695c33da3221a25b924e834b68a535a5e66e7fd48c0bce052d7e010b43163fc7b775a1f91a4021b6637bba4ff3c6
SSDEEP

3072:dwUdJiVyG3yEdhcmLF8RuQKXM/FJsWQ4YgTuosTc+43Ggo/Mzrl/Z4++UnMryAlu:+UdJiuE3TeOoUWbYnfnknDL+UnMryAl

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  b2265cf131901f3f2553023b29ececa0927ea71e283bb4976883045bd1b5a96e
- Size
  
  216KB
- MD5
  
  56e194f08625e669fe2adf839a2d3c3e
- SHA1
  
  f1a175648979ff62915cb7bbc9748ce35ac7ce34
- SHA256
  
  b2265cf131901f3f2553023b29ececa0927ea71e283bb4976883045bd1b5a96e
- SHA512
  
  05668c29424929494e6f611edc3761efd686695c33da3221a25b924e834b68a535a5e66e7fd48c0bce052d7e010b43163fc7b775a1f91a4021b6637bba4ff3c6
- SSDEEP
  
  3072:dwUdJiVyG3yEdhcmLF8RuQKXM/FJsWQ4YgTuosTc+43Ggo/Mzrl/Z4++UnMryAlu:+UdJiuE3TeOoUWbYnfnknDL+UnMryAl
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2