General
-
Target
901cec222bef9173d884fcd170a7d100
-
Size
2.2MB
-
Sample
240204-zjhepaacg7
-
MD5
901cec222bef9173d884fcd170a7d100
-
SHA1
0e0572af28ca58f8cc75464e6eb0a4f3c9441c8a
-
SHA256
ea57a2c8f5a67893e8017873944a66459454e85caa8111d658142c1e5b649d0f
-
SHA512
9f7ae63665e7634e5ee8904442f2e1cc5c7e227466e88c24c334a2e2f4171bb56c637324725e2f9766d28bfce52b10beb05640d7f57c233293b8ecb4101966a6
-
SSDEEP
49152:AtKOxEdZnHsIpu7ro2pYwemN0Cz4aFXwZOwmtU3jaBYhfm8alB+tXP:AFErMIwbye5pFgxmtUmmeZWP
Static task
static1
Behavioral task
behavioral1
Sample
901cec222bef9173d884fcd170a7d100.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
901cec222bef9173d884fcd170a7d100.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
http://galaint.coolsecupdate.info/?0=115&1=1&2=1&3=42&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=hljibwhwht&14=1
Extracted
http://galaint.coolsecupdate.info/?0=115&1=1&2=1&3=42&4=i&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=0000&12=glhflaywem&14=1
Targets
-
-
Target
901cec222bef9173d884fcd170a7d100
-
Size
2.2MB
-
MD5
901cec222bef9173d884fcd170a7d100
-
SHA1
0e0572af28ca58f8cc75464e6eb0a4f3c9441c8a
-
SHA256
ea57a2c8f5a67893e8017873944a66459454e85caa8111d658142c1e5b649d0f
-
SHA512
9f7ae63665e7634e5ee8904442f2e1cc5c7e227466e88c24c334a2e2f4171bb56c637324725e2f9766d28bfce52b10beb05640d7f57c233293b8ecb4101966a6
-
SSDEEP
49152:AtKOxEdZnHsIpu7ro2pYwemN0Cz4aFXwZOwmtU3jaBYhfm8alB+tXP:AFErMIwbye5pFgxmtUmmeZWP
Score10/10-
Disables taskbar notifications via registry modification
-
Sets file execution options in registry
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1