2993c3b75eb2fc7a6805e25da49fedae1173f8df9a0b0f153cbf8a4eed7ad5c8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

79c84b17c5d932ac24db09982255993c
Size

1.4MB
Sample

240127-kmsx9sadfr
MD5

79c84b17c5d932ac24db09982255993c
SHA1

ca508f81d9c0b3b8996cb6cd394246842f8b74d9
SHA256

2993c3b75eb2fc7a6805e25da49fedae1173f8df9a0b0f153cbf8a4eed7ad5c8
SHA512

8e3ce3a69a2722271a890d3a44628f3f21231aac9d1a0e6423b5eee37e7c89c375dcd6b58f5369f6f792d40a931ea50b1b0491bc80c6b5fb7e227adb0c8c8593
SSDEEP

24576:qkICCnxKUR1Om+BVJx8qRT6PFQQ26zfzemThJjks8TOvcoKu:q5CCxzwQ2GeM/jkevco5

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  79c84b17c5d932ac24db09982255993c
- Size
  
  1.4MB
- MD5
  
  79c84b17c5d932ac24db09982255993c
- SHA1
  
  ca508f81d9c0b3b8996cb6cd394246842f8b74d9
- SHA256
  
  2993c3b75eb2fc7a6805e25da49fedae1173f8df9a0b0f153cbf8a4eed7ad5c8
- SHA512
  
  8e3ce3a69a2722271a890d3a44628f3f21231aac9d1a0e6423b5eee37e7c89c375dcd6b58f5369f6f792d40a931ea50b1b0491bc80c6b5fb7e227adb0c8c8593
- SSDEEP
  
  24576:qkICCnxKUR1Om+BVJx8qRT6PFQQ26zfzemThJjks8TOvcoKu:q5CCxzwQ2GeM/jkevco5
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2