bdd21df5f72d76887f1169cfee36e3e5d356393dc7c2f1a00b823d1b7fb14669 | Triage

Sharing

General

Target

02e38ead5b7eb36b4e75ae5cada42ce8
Size

45KB
Sample

231229-y394daead4
MD5

02e38ead5b7eb36b4e75ae5cada42ce8
SHA1

69f7365bb1c0214d399167ecc6083578fd4fa104
SHA256

bdd21df5f72d76887f1169cfee36e3e5d356393dc7c2f1a00b823d1b7fb14669
SHA512

36e3b4775491f707a93f1e0e5b27f67b51942c45f43c615b5a4942cc9cbf56b96b5e065c022748dcf351af0a2d2428db96dbea058bb48c77ea90394d42d17a54
SSDEEP

768:YrTIuL/HwghTVV4WEcuAoMQdQmxxSA33149RpM/shb:gHbhTVV4WEcJAFF49Re/8

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  02e38ead5b7eb36b4e75ae5cada42ce8
- Size
  
  45KB
- MD5
  
  02e38ead5b7eb36b4e75ae5cada42ce8
- SHA1
  
  69f7365bb1c0214d399167ecc6083578fd4fa104
- SHA256
  
  bdd21df5f72d76887f1169cfee36e3e5d356393dc7c2f1a00b823d1b7fb14669
- SHA512
  
  36e3b4775491f707a93f1e0e5b27f67b51942c45f43c615b5a4942cc9cbf56b96b5e065c022748dcf351af0a2d2428db96dbea058bb48c77ea90394d42d17a54
- SSDEEP
  
  768:YrTIuL/HwghTVV4WEcuAoMQdQmxxSA33149RpM/shb:gHbhTVV4WEcJAFF49Re/8
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2