be2b36a1fd8d91f9c86043b1afa8a87acbc935d6087d0ed2e565ddcf4f7c9504 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be2b36a1fd8d91f9c86043b1afa8a87acbc935d6087d0ed2e565ddcf4f7c9504.exe
Size

37KB
Sample

230603-maeafsgg9s
MD5

5a27aa4197d981f11fd3f92e012f3cc1
SHA1

10a94707b788f64cd683b0e6fb2511b2df6da18f
SHA256

be2b36a1fd8d91f9c86043b1afa8a87acbc935d6087d0ed2e565ddcf4f7c9504
SHA512

8282e539c09a413f57816b2b63fb661edbd68914b3b848e67dcba1fdb2517a92cb333a48594af52adb6761f1c5815119dc2fa9f9f72739a514823ccddc838f54
SSDEEP

768:rr0q7cCi87fYxVxNo1A1W6+VYspAvCjOCNewWJ:rAlU0VxCHVAvkZ3WJ

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  be2b36a1fd8d91f9c86043b1afa8a87acbc935d6087d0ed2e565ddcf4f7c9504.exe
- Size
  
  37KB
- MD5
  
  5a27aa4197d981f11fd3f92e012f3cc1
- SHA1
  
  10a94707b788f64cd683b0e6fb2511b2df6da18f
- SHA256
  
  be2b36a1fd8d91f9c86043b1afa8a87acbc935d6087d0ed2e565ddcf4f7c9504
- SHA512
  
  8282e539c09a413f57816b2b63fb661edbd68914b3b848e67dcba1fdb2517a92cb333a48594af52adb6761f1c5815119dc2fa9f9f72739a514823ccddc838f54
- SSDEEP
  
  768:rr0q7cCi87fYxVxNo1A1W6+VYspAvCjOCNewWJ:rAlU0VxCHVAvkZ3WJ
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2