f15b8a71f8f4c2281fc5a3adc44ba2920fb6ee2194165521c4f367cac9ef653e | Triage

Sharing

General

Target

NEAS.e6aebf6eb4ff626ad0a2ecb7f7146c00.exe
Size

123KB
Sample

231031-kyaaasgf69
MD5

e6aebf6eb4ff626ad0a2ecb7f7146c00
SHA1

fef50f36aa3c8b6bda0604f7a51b33d6d6d0daf7
SHA256

f15b8a71f8f4c2281fc5a3adc44ba2920fb6ee2194165521c4f367cac9ef653e
SHA512

fadf556013a3fd50cf5c538716cf1d3250542992be4075f2f8e1ba1dd5fb5ad9b0ffb9f48c8f434286de1ef15fb5a70a1e50934a64aa8aef41d0e9a18f6efb2f
SSDEEP

3072:PfU/WF6QMauSuiWNi9CO+WARJrWNZIYvQd2b:AWKauSuiWNiUBRJrW7fb

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  NEAS.e6aebf6eb4ff626ad0a2ecb7f7146c00.exe
- Size
  
  123KB
- MD5
  
  e6aebf6eb4ff626ad0a2ecb7f7146c00
- SHA1
  
  fef50f36aa3c8b6bda0604f7a51b33d6d6d0daf7
- SHA256
  
  f15b8a71f8f4c2281fc5a3adc44ba2920fb6ee2194165521c4f367cac9ef653e
- SHA512
  
  fadf556013a3fd50cf5c538716cf1d3250542992be4075f2f8e1ba1dd5fb5ad9b0ffb9f48c8f434286de1ef15fb5a70a1e50934a64aa8aef41d0e9a18f6efb2f
- SSDEEP
  
  3072:PfU/WF6QMauSuiWNi9CO+WARJrWNZIYvQd2b:AWKauSuiWNiUBRJrW7fb
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2