9debd4994eb4ce5ea2de8190dc6c57dcdbf1c1b7ed377e30d137d4d578248236 | Triage

Sharing

General

Target

9debd4994eb4ce5ea2de8190dc6c57dcdbf1c1b7ed377e30d137d4d578248236
Size

10.4MB
Sample

231012-2rjc3afg48
MD5

506bbfd7dcf27d7872637a7a520c568a
SHA1

dc415f56cc7591af163a00d349ee6e9b9f68662d
SHA256

9debd4994eb4ce5ea2de8190dc6c57dcdbf1c1b7ed377e30d137d4d578248236
SHA512

1eb08d66b288dec083260cf83ea9f28a80d86491068ac626796d4d4dbf3d022e84e28deda31b52edacb10346336c583dc35d528796171107085017af82203934
SSDEEP

196608:GIW0FhhUhDmxLCvXfLCGP1a43rCUxaxF3jV1KnEaLbThHjsiCFB0+U0j/aP:GIxF3UVmxLevOG9a4eLF3x1KzThH4iCW

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  9debd4994eb4ce5ea2de8190dc6c57dcdbf1c1b7ed377e30d137d4d578248236
- Size
  
  10.4MB
- MD5
  
  506bbfd7dcf27d7872637a7a520c568a
- SHA1
  
  dc415f56cc7591af163a00d349ee6e9b9f68662d
- SHA256
  
  9debd4994eb4ce5ea2de8190dc6c57dcdbf1c1b7ed377e30d137d4d578248236
- SHA512
  
  1eb08d66b288dec083260cf83ea9f28a80d86491068ac626796d4d4dbf3d022e84e28deda31b52edacb10346336c583dc35d528796171107085017af82203934
- SSDEEP
  
  196608:GIW0FhhUhDmxLCvXfLCGP1a43rCUxaxF3jV1KnEaLbThHjsiCFB0+U0j/aP:GIxF3UVmxLevOG9a4eLF3x1KzThH4iCW
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2