fe2b61dd86bf64fe084a50831ba01211c52ec6fdc77d5a5e6931b25a25c64e11 | Triage

Sharing

General

Target

fe2b61dd86bf64fe084a50831ba01211c52ec6fdc77d5a5e6931b25a25c64e11
Size

1.1MB
Sample

221206-3ndtvaef34
MD5

2f969320b014a432edea0a2c25f7030b
SHA1

1dcaecad9a65d61486e10e4871692cad1aa2a92e
SHA256

fe2b61dd86bf64fe084a50831ba01211c52ec6fdc77d5a5e6931b25a25c64e11
SHA512

87919f3f635103993333a9bce3adbae366b7695e732b1e9c78268a61a0f900be87ffb756e04a5638e889247a1b2a58c7bbc4e790d8aef6005476208a27e2cf1b
SSDEEP

12288:kCSPzc2+LuQf/tYBdm2fIpjEhWVETVcDmx1yo:VJt1TVd2omXyo

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  fe2b61dd86bf64fe084a50831ba01211c52ec6fdc77d5a5e6931b25a25c64e11
- Size
  
  1.1MB
- MD5
  
  2f969320b014a432edea0a2c25f7030b
- SHA1
  
  1dcaecad9a65d61486e10e4871692cad1aa2a92e
- SHA256
  
  fe2b61dd86bf64fe084a50831ba01211c52ec6fdc77d5a5e6931b25a25c64e11
- SHA512
  
  87919f3f635103993333a9bce3adbae366b7695e732b1e9c78268a61a0f900be87ffb756e04a5638e889247a1b2a58c7bbc4e790d8aef6005476208a27e2cf1b
- SSDEEP
  
  12288:kCSPzc2+LuQf/tYBdm2fIpjEhWVETVcDmx1yo:VJt1TVd2omXyo
Score

8^/10

persistence
- Executes dropped EXE
- Modifies AppInit DLL entries
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2