General
-
Target
4cc2a7ec4391819c1cb4934749891d47
-
Size
2.1MB
-
Sample
240108-3phjesfefq
-
MD5
4cc2a7ec4391819c1cb4934749891d47
-
SHA1
5c42e67be5599f39f3c26c22db465a2caaf990fe
-
SHA256
1e32e37f0155798afe17b899df50d1071cd0d82efacbcf3459c5547764624cd6
-
SHA512
cf146fee4e03965a17beabfac7a9dec43fd118c63ad9de979ceb7abde5524d4caf9def92c389e4b63f4d95599514d5e2ec519926f9ec5cf4792425783f33e251
-
SSDEEP
49152:D6qN8ilbrEnWgKPW7b9L+Cpg4yy+xHE6R4dL/g17kfCnBt2uThJ:DVvskgB+Cut5E3dLhCnmuThJ
Static task
static1
Behavioral task
behavioral1
Sample
4cc2a7ec4391819c1cb4934749891d47.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4cc2a7ec4391819c1cb4934749891d47.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
http://galaint.online-secure-pay.info/?0=115&1=1&2=1&3=26&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=kmtcdjvkgj&14=1
Targets
-
-
Target
4cc2a7ec4391819c1cb4934749891d47
-
Size
2.1MB
-
MD5
4cc2a7ec4391819c1cb4934749891d47
-
SHA1
5c42e67be5599f39f3c26c22db465a2caaf990fe
-
SHA256
1e32e37f0155798afe17b899df50d1071cd0d82efacbcf3459c5547764624cd6
-
SHA512
cf146fee4e03965a17beabfac7a9dec43fd118c63ad9de979ceb7abde5524d4caf9def92c389e4b63f4d95599514d5e2ec519926f9ec5cf4792425783f33e251
-
SSDEEP
49152:D6qN8ilbrEnWgKPW7b9L+Cpg4yy+xHE6R4dL/g17kfCnBt2uThJ:DVvskgB+Cut5E3dLhCnmuThJ
Score10/10-
Disables taskbar notifications via registry modification
-
Sets file execution options in registry
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1