ef643cd0d1b432d6db1e9dc20fb3868f30903a302763738a31e8f391f385b92e | Triage

Sharing

General

Target

ef643cd0d1b432d6db1e9dc20fb3868f30903a302763738a31e8f391f385b92e
Size

519KB
Sample

221206-28eq7sdb69
MD5

525f1adc261eeb1bba5366b5d1ee905c
SHA1

812a785e0a5c8c0ed54c8a82c42240d00005aee6
SHA256

ef643cd0d1b432d6db1e9dc20fb3868f30903a302763738a31e8f391f385b92e
SHA512

f9280c974703b0176847c697b77e60c3603662226375c56a5142a2d24dca74aae8b8385c26cd3bfc22580150a5cf268d584c7c696bf2dd1c1058db10050edad8
SSDEEP

12288:jbQg8276OuF2qLSt3+Ofr+aD991RpvknDhDI2JCU77Uu:jbQg827TuF22SJzfygX1RpsDI2AU7v

Score

8^/10

Malware Config

Targets

- Target
  
  ef643cd0d1b432d6db1e9dc20fb3868f30903a302763738a31e8f391f385b92e
- Size
  
  519KB
- MD5
  
  525f1adc261eeb1bba5366b5d1ee905c
- SHA1
  
  812a785e0a5c8c0ed54c8a82c42240d00005aee6
- SHA256
  
  ef643cd0d1b432d6db1e9dc20fb3868f30903a302763738a31e8f391f385b92e
- SHA512
  
  f9280c974703b0176847c697b77e60c3603662226375c56a5142a2d24dca74aae8b8385c26cd3bfc22580150a5cf268d584c7c696bf2dd1c1058db10050edad8
- SSDEEP
  
  12288:jbQg8276OuF2qLSt3+Ofr+aD991RpvknDhDI2JCU77Uu:jbQg827TuF22SJzfygX1RpsDI2AU7v
Score

8^/10
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2