General
-
Target
78e097912f7d18dc19b716f35a2b58dd
-
Size
2.0MB
-
Sample
240127-bg1w9aaag2
-
MD5
78e097912f7d18dc19b716f35a2b58dd
-
SHA1
75cfd8eba27caf189bdc668f5be16d936df954ce
-
SHA256
d58642ba8acce1a1772334a99ec77a9480d8df8aceb1da121eaa2e4f9eafffa2
-
SHA512
c9ad6fbb86c4b4c4ad4b6d754687e6c8d008054283859c5b9337c520d7ba7d5b7c120f53c211c77a8990aa330986e66d7804895c51f7a222d47a83c6be737fa9
-
SSDEEP
49152:rTcKtjmfpQzizFagOIX+MJnrDoqJWB2te8RI6ZwjMy:rTdmRQGzMcXlIqU048RpZwj
Static task
static1
Behavioral task
behavioral1
Sample
78e097912f7d18dc19b716f35a2b58dd.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
78e097912f7d18dc19b716f35a2b58dd.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
http://galaint.onlinesecstats.info/?0=115&1=1&2=1&3=55&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=tgmmlxurxe&14=1
Targets
-
-
Target
78e097912f7d18dc19b716f35a2b58dd
-
Size
2.0MB
-
MD5
78e097912f7d18dc19b716f35a2b58dd
-
SHA1
75cfd8eba27caf189bdc668f5be16d936df954ce
-
SHA256
d58642ba8acce1a1772334a99ec77a9480d8df8aceb1da121eaa2e4f9eafffa2
-
SHA512
c9ad6fbb86c4b4c4ad4b6d754687e6c8d008054283859c5b9337c520d7ba7d5b7c120f53c211c77a8990aa330986e66d7804895c51f7a222d47a83c6be737fa9
-
SSDEEP
49152:rTcKtjmfpQzizFagOIX+MJnrDoqJWB2te8RI6ZwjMy:rTdmRQGzMcXlIqU048RpZwj
Score10/10-
Disables taskbar notifications via registry modification
-
Sets file execution options in registry
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1