b18ccdfaa2cfed011dc356fe7d315f795fc2894d03c9092192d81dc8caf0b75c | Triage

Sharing

General

Target

b18ccdfaa2cfed011dc356fe7d315f795fc2894d03c9092192d81dc8caf0b75c
Size

333KB
Sample

221204-dfyrlsba46
MD5

b57d827eb7e524c3abb42a7941ec1c77
SHA1

b3d2a59e3649217fdad21b3d822a27eda1950fc1
SHA256

b18ccdfaa2cfed011dc356fe7d315f795fc2894d03c9092192d81dc8caf0b75c
SHA512

1fd8b10e8c3b7b7665a73e62590d1be49055d38a1c026b1967179822b5f8ab41d088094b8bfc2d2fb86ca294c9e86059a63ccd4a399aeb41e96ae49f9015230b
SSDEEP

6144:rjrlCHxyhK7JhqF6muLi8YV+oM/JHLdmQndK1d0Jyc6xBiW/0:HrlzK7vC6HLifEBQlKJMc

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  b18ccdfaa2cfed011dc356fe7d315f795fc2894d03c9092192d81dc8caf0b75c
- Size
  
  333KB
- MD5
  
  b57d827eb7e524c3abb42a7941ec1c77
- SHA1
  
  b3d2a59e3649217fdad21b3d822a27eda1950fc1
- SHA256
  
  b18ccdfaa2cfed011dc356fe7d315f795fc2894d03c9092192d81dc8caf0b75c
- SHA512
  
  1fd8b10e8c3b7b7665a73e62590d1be49055d38a1c026b1967179822b5f8ab41d088094b8bfc2d2fb86ca294c9e86059a63ccd4a399aeb41e96ae49f9015230b
- SSDEEP
  
  6144:rjrlCHxyhK7JhqF6muLi8YV+oM/JHLdmQndK1d0Jyc6xBiW/0:HrlzK7vC6HLifEBQlKJMc
Score

8^/10

persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2