67a55d420bf195022394699708aea99e75a9fb1c200b59254f6895d0e14421a0 | Triage

Sharing

General

Target

16d1997591227b6249c22ed85681206e
Size

7.9MB
Sample

231219-nvt23sdcfl
MD5

16d1997591227b6249c22ed85681206e
SHA1

8f495cc1f1f7d98289e15d878e6a7dd51e69b8ea
SHA256

67a55d420bf195022394699708aea99e75a9fb1c200b59254f6895d0e14421a0
SHA512

9eb867a8872d42ba6268dddf65c558b23689f40698752e0ce2a0ed6cb8ad14f4f576e5dcddcd2ddb5e4fb9bea710fa3bb73b8c4d5d9b7f1329562a5f8666d4c4
SSDEEP

196608:8Eazg7DSmEazg7DSmEazg7DSmEazg7DSN:qg7u4g7u4g7u4g7uN

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  16d1997591227b6249c22ed85681206e
- Size
  
  7.9MB
- MD5
  
  16d1997591227b6249c22ed85681206e
- SHA1
  
  8f495cc1f1f7d98289e15d878e6a7dd51e69b8ea
- SHA256
  
  67a55d420bf195022394699708aea99e75a9fb1c200b59254f6895d0e14421a0
- SHA512
  
  9eb867a8872d42ba6268dddf65c558b23689f40698752e0ce2a0ed6cb8ad14f4f576e5dcddcd2ddb5e4fb9bea710fa3bb73b8c4d5d9b7f1329562a5f8666d4c4
- SSDEEP
  
  196608:8Eazg7DSmEazg7DSmEazg7DSmEazg7DSN:qg7u4g7u4g7u4g7uN
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2