2bdddb09bd97485a8662ccf069a3c10963559f12c23045fa3dd28bc0c56851e4 | Triage

Sharing

General

Target

e0108c567b623ef4804638d892ab2fa3
Size

70KB
Sample

240326-zldjhseh4v
MD5

e0108c567b623ef4804638d892ab2fa3
SHA1

4e9b33976d8f25eb941883476a0da50fe7726faa
SHA256

2bdddb09bd97485a8662ccf069a3c10963559f12c23045fa3dd28bc0c56851e4
SHA512

85f79109e7f62f9e5618fc42d5ed79aa05ee4cca943048dd4b093cf30709fd76f79e791172890f891ab5e3974abbe26ffd58f3c91478ae7f0c09d83a03bb6e04
SSDEEP

1536:g3Tvc4o6pYScxHmkq6UwmAYzj/8sJQ26bk5NV3h4TFu:go4Y7bdmAWj/JGbl

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  e0108c567b623ef4804638d892ab2fa3
- Size
  
  70KB
- MD5
  
  e0108c567b623ef4804638d892ab2fa3
- SHA1
  
  4e9b33976d8f25eb941883476a0da50fe7726faa
- SHA256
  
  2bdddb09bd97485a8662ccf069a3c10963559f12c23045fa3dd28bc0c56851e4
- SHA512
  
  85f79109e7f62f9e5618fc42d5ed79aa05ee4cca943048dd4b093cf30709fd76f79e791172890f891ab5e3974abbe26ffd58f3c91478ae7f0c09d83a03bb6e04
- SSDEEP
  
  1536:g3Tvc4o6pYScxHmkq6UwmAYzj/8sJQ26bk5NV3h4TFu:go4Y7bdmAWj/JGbl
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2