dd920bb95957a1fe939ee6817b0412f85ec60b126c41e04e42e4e9bca5b29fc9 | Triage

Sharing

General

Target

dd920bb95957a1fe939ee6817b0412f85ec60b126c41e04e42e4e9bca5b29fc9
Size

212KB
Sample

221204-qex5xafe6s
MD5

f1cd5b24766cfa44b50adcbeaeaa313d
SHA1

1889df78e47965ff4abbfd8db000749fd17655ec
SHA256

dd920bb95957a1fe939ee6817b0412f85ec60b126c41e04e42e4e9bca5b29fc9
SHA512

cec4b6f57d3529dfd454040bde39f4b6ff08f8fa996ade407360f83ddae3cff65f76f2c0de78f564a6706860988063695f504446ad02a89bb0e78e3bb3f72fc8
SSDEEP

6144:YaHV635D2m+3Wl0FUZWI/27Q68Z11psjHuv:/V635D2muFU8I/M/M12a

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  dd920bb95957a1fe939ee6817b0412f85ec60b126c41e04e42e4e9bca5b29fc9
- Size
  
  212KB
- MD5
  
  f1cd5b24766cfa44b50adcbeaeaa313d
- SHA1
  
  1889df78e47965ff4abbfd8db000749fd17655ec
- SHA256
  
  dd920bb95957a1fe939ee6817b0412f85ec60b126c41e04e42e4e9bca5b29fc9
- SHA512
  
  cec4b6f57d3529dfd454040bde39f4b6ff08f8fa996ade407360f83ddae3cff65f76f2c0de78f564a6706860988063695f504446ad02a89bb0e78e3bb3f72fc8
- SSDEEP
  
  6144:YaHV635D2m+3Wl0FUZWI/27Q68Z11psjHuv:/V635D2muFU8I/M/M12a
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2