ef283db1b923e67d20cbf069c1418eb6cc0d0cca235e6a53e5b535d668daec41 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef283db1b923e67d20cbf069c1418eb6cc0d0cca235e6a53e5b535d668daec41
Size

150KB
Sample

221206-zmpm6sfa4t
MD5

951c1f3ea43a0769e1eeb9d8a20a788e
SHA1

c7eb6ec08faef511d48c98cd3b56cebd739b07a1
SHA256

ef283db1b923e67d20cbf069c1418eb6cc0d0cca235e6a53e5b535d668daec41
SHA512

16c97e7aaa8bde0d4ba08f71e7a4c0f5ac197aeb294c5a9b527f9492ba50204c7b717603dfa6523ca10a5b01e2b4959667ff138cffb0629853d1b6b49e96e61f
SSDEEP

3072:YZf5fkumG9ejaVQol93KxDjcC1InX7wPXhSWaI9ENpWXviEdVnbXK:QugzVQolwjcC1IX7wJHaI9EOXvldVb6

Score

8^/10

Malware Config

Targets

- Target
  
  ef283db1b923e67d20cbf069c1418eb6cc0d0cca235e6a53e5b535d668daec41
- Size
  
  150KB
- MD5
  
  951c1f3ea43a0769e1eeb9d8a20a788e
- SHA1
  
  c7eb6ec08faef511d48c98cd3b56cebd739b07a1
- SHA256
  
  ef283db1b923e67d20cbf069c1418eb6cc0d0cca235e6a53e5b535d668daec41
- SHA512
  
  16c97e7aaa8bde0d4ba08f71e7a4c0f5ac197aeb294c5a9b527f9492ba50204c7b717603dfa6523ca10a5b01e2b4959667ff138cffb0629853d1b6b49e96e61f
- SSDEEP
  
  3072:YZf5fkumG9ejaVQol93KxDjcC1InX7wPXhSWaI9ENpWXviEdVnbXK:QugzVQolwjcC1IX7wJHaI9EOXvldVb6
Score

8^/10
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2