45c4f612e110e8b15e237b945d44dce6c1079d3406ae1409dc85b35f4db5d37e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d77c025fac3785f37325753bbef8c7a
Size

38KB
Sample

231230-ed3s8ahga9
MD5

0d77c025fac3785f37325753bbef8c7a
SHA1

ef3b9b585696b3aea247df80c61b47b6e0ac455d
SHA256

45c4f612e110e8b15e237b945d44dce6c1079d3406ae1409dc85b35f4db5d37e
SHA512

d0d9aed93dfd758999235136a8ce93f157fdcd90fb0d0041550487c2f09866ef9c54cd96ea08b274d2e5da18ca2525e209b14e907f662d72566f4f3ebe409b6a
SSDEEP

768:n85uCqeMsD1UNCT3+P01ghIL4y/HbbYkFwL+b1CqAMm:4AUt3+s1P4CbbYkFwybYqzm

Score

7^/10

Malware Config

Targets

- Target
  
  0d77c025fac3785f37325753bbef8c7a
- Size
  
  38KB
- MD5
  
  0d77c025fac3785f37325753bbef8c7a
- SHA1
  
  ef3b9b585696b3aea247df80c61b47b6e0ac455d
- SHA256
  
  45c4f612e110e8b15e237b945d44dce6c1079d3406ae1409dc85b35f4db5d37e
- SHA512
  
  d0d9aed93dfd758999235136a8ce93f157fdcd90fb0d0041550487c2f09866ef9c54cd96ea08b274d2e5da18ca2525e209b14e907f662d72566f4f3ebe409b6a
- SSDEEP
  
  768:n85uCqeMsD1UNCT3+P01ghIL4y/HbbYkFwL+b1CqAMm:4AUt3+s1P4CbbYkFwybYqzm
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2