a1ef70acae76ade1dd97c438a53e0509aea9a7731ef1b2ea1ed7af72b9a4b483 | Triage

Sharing

General

Target

a1ef70acae76ade1dd97c438a53e0509aea9a7731ef1b2ea1ed7af72b9a4b483
Size

1.3MB
Sample

221206-t5mcwahb6y
MD5

445cc09df6d3eacb86e62f899e26723c
SHA1

4fadbaaf230b737d8698949114dee55e0ac5eb07
SHA256

a1ef70acae76ade1dd97c438a53e0509aea9a7731ef1b2ea1ed7af72b9a4b483
SHA512

22535829a565511e8cb0d4d10d531a904abb31f7fed6a66ccaddb7ca6527261bf65009d0f06f99929c7c13df461e1ff2e5430a1eedbf2f3a1ac78d448c748ba4
SSDEEP

24576:9Tj8xWBOL2//mHhu3nJ36b5ACS2qcGpXUrgcXYgOh3cLCq9IBRiN:Fpd+EdcS2qcIXUEcXYgOJblB0

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  a1ef70acae76ade1dd97c438a53e0509aea9a7731ef1b2ea1ed7af72b9a4b483
- Size
  
  1.3MB
- MD5
  
  445cc09df6d3eacb86e62f899e26723c
- SHA1
  
  4fadbaaf230b737d8698949114dee55e0ac5eb07
- SHA256
  
  a1ef70acae76ade1dd97c438a53e0509aea9a7731ef1b2ea1ed7af72b9a4b483
- SHA512
  
  22535829a565511e8cb0d4d10d531a904abb31f7fed6a66ccaddb7ca6527261bf65009d0f06f99929c7c13df461e1ff2e5430a1eedbf2f3a1ac78d448c748ba4
- SSDEEP
  
  24576:9Tj8xWBOL2//mHhu3nJ36b5ACS2qcGpXUrgcXYgOh3cLCq9IBRiN:Fpd+EdcS2qcIXUEcXYgOJblB0
Score

8^/10

persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2