901f7535a6a8b84cd9f14c845117a18413665659d1677bf9d5812c06f0bfdce9 | Triage

Sharing

General

Target

901f7535a6a8b84cd9f14c845117a18413665659d1677bf9d5812c06f0bfdce9
Size

700KB
Sample

221204-avzqnseh4v
MD5

3aad2965a01f273112c501888feeac4a
SHA1

a06a1fc0c73e226553923946dee42b5b7a90b304
SHA256

901f7535a6a8b84cd9f14c845117a18413665659d1677bf9d5812c06f0bfdce9
SHA512

0eddeb11374f39105e88d91a07b1501ef09b06f47d0718776e06affff0fc39630ff1a5b0ab1882b4c83bb3a93a26eac07f92ff495fbb98c4f255c823137524e0
SSDEEP

12288:AN+LbOurqW8AuLexBtRDgNCrrxHeGCcbLx:HOurqW8AuL8fD4CrrsGCcx

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  901f7535a6a8b84cd9f14c845117a18413665659d1677bf9d5812c06f0bfdce9
- Size
  
  700KB
- MD5
  
  3aad2965a01f273112c501888feeac4a
- SHA1
  
  a06a1fc0c73e226553923946dee42b5b7a90b304
- SHA256
  
  901f7535a6a8b84cd9f14c845117a18413665659d1677bf9d5812c06f0bfdce9
- SHA512
  
  0eddeb11374f39105e88d91a07b1501ef09b06f47d0718776e06affff0fc39630ff1a5b0ab1882b4c83bb3a93a26eac07f92ff495fbb98c4f255c823137524e0
- SSDEEP
  
  12288:AN+LbOurqW8AuLexBtRDgNCrrxHeGCcbLx:HOurqW8AuL8fD4CrrsGCcx
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2