d54779db2e1229fd52e0f90f52422accfa374f74645a9ca20503e2c8a6669630 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SEPTEMBER SOA UPDATED.exe
Size

697KB
Sample

231011-hfa3rshe56
MD5

c168d1d3280b593afad44345005394c7
SHA1

ddc7e2bae92d3b9ffada893d9d15bfcca8e7e267
SHA256

d54779db2e1229fd52e0f90f52422accfa374f74645a9ca20503e2c8a6669630
SHA512

5803f8cf1a3b750c11e5ef2db499ddce0adc22d5d616e6a6c526efe60324cc09d62cfcf839c82f55158acbf6193b96c50358ef67fe4d0f4bfb7fb92fc2e630b2
SSDEEP

12288:KccAckjm+aMz4vYr9Jm1Zcq12jFncwQcs4T/9naWP8I6aiCwPtck8YU:ski/M8qmjNSncwFZda5aiCKCTY

Score

7^/10

Malware Config

Targets

- Target
  
  SEPTEMBER SOA UPDATED.exe
- Size
  
  697KB
- MD5
  
  c168d1d3280b593afad44345005394c7
- SHA1
  
  ddc7e2bae92d3b9ffada893d9d15bfcca8e7e267
- SHA256
  
  d54779db2e1229fd52e0f90f52422accfa374f74645a9ca20503e2c8a6669630
- SHA512
  
  5803f8cf1a3b750c11e5ef2db499ddce0adc22d5d616e6a6c526efe60324cc09d62cfcf839c82f55158acbf6193b96c50358ef67fe4d0f4bfb7fb92fc2e630b2
- SSDEEP
  
  12288:KccAckjm+aMz4vYr9Jm1Zcq12jFncwQcs4T/9naWP8I6aiCwPtck8YU:ski/M8qmjNSncwFZda5aiCKCTY
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2