8cacac617ff84f1de39ba20a37e0c4b751c3a6574d6520f5995d19d6534194ea | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8cacac617ff84f1de39ba20a37e0c4b751c3a6574d6520f5995d19d6534194ea
Size

136KB
Sample

221206-mrfjvaad63
MD5

5529101db102bcd21dd3c9c2b54e59a0
SHA1

fbe865eda65f8aac009044089b072e1cc80d5c3a
SHA256

8cacac617ff84f1de39ba20a37e0c4b751c3a6574d6520f5995d19d6534194ea
SHA512

2cc134cb4d91ae583406c89e59ab6fe0fad840bcd541fc6952ca9024de9fd8ebdbb44f33a65baa38cf8e7af3217ebf689594b1a15740f82c8354de6f3c95f018
SSDEEP

1536:tGfLyi9iKORK83h/By8jqhWpRePs9vxRvJ7d1UzeJXMvIHpQ93nV6mSS9Tb7B8:7iG3hTVRLZHPHpYnV6QTva

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  8cacac617ff84f1de39ba20a37e0c4b751c3a6574d6520f5995d19d6534194ea
- Size
  
  136KB
- MD5
  
  5529101db102bcd21dd3c9c2b54e59a0
- SHA1
  
  fbe865eda65f8aac009044089b072e1cc80d5c3a
- SHA256
  
  8cacac617ff84f1de39ba20a37e0c4b751c3a6574d6520f5995d19d6534194ea
- SHA512
  
  2cc134cb4d91ae583406c89e59ab6fe0fad840bcd541fc6952ca9024de9fd8ebdbb44f33a65baa38cf8e7af3217ebf689594b1a15740f82c8354de6f3c95f018
- SSDEEP
  
  1536:tGfLyi9iKORK83h/By8jqhWpRePs9vxRvJ7d1UzeJXMvIHpQ93nV6mSS9Tb7B8:7iG3hTVRLZHPHpYnV6QTva
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2