9462b76ac528bdec226b714ce6e8756fff28f33048897ed1e11ec73218e8d1e4 | Triage

Sharing

General

Target

SecuriteInfo.com.Tool.Nssm.5.28597.25829.exe
Size

2.3MB
Sample

240409-z8fmdsbg45
MD5

12bd32c54d014ca722ac95b87bf78331
SHA1

96828fa8bde3d52a84a979e2b056dda403d05841
SHA256

9462b76ac528bdec226b714ce6e8756fff28f33048897ed1e11ec73218e8d1e4
SHA512

03da3edf29165da936a182e10f0725c571ef9fa92db2c0bd51fc87a3e17305f94fa543fa851f90282ee887d7b3eb0a8400c3df95dc7b2eac7c2902222bdd3526
SSDEEP

49152:zgwRwVkqb4dzwJSxAI+hbusA0Oyo9T/DSNNdar0RIzJCD:zgwRucB4SxqbusAvnroYID

Score

8^/10

evasion

Malware Config

Targets

- Target
  
  SecuriteInfo.com.Tool.Nssm.5.28597.25829.exe
- Size
  
  2.3MB
- MD5
  
  12bd32c54d014ca722ac95b87bf78331
- SHA1
  
  96828fa8bde3d52a84a979e2b056dda403d05841
- SHA256
  
  9462b76ac528bdec226b714ce6e8756fff28f33048897ed1e11ec73218e8d1e4
- SHA512
  
  03da3edf29165da936a182e10f0725c571ef9fa92db2c0bd51fc87a3e17305f94fa543fa851f90282ee887d7b3eb0a8400c3df95dc7b2eac7c2902222bdd3526
- SSDEEP
  
  49152:zgwRwVkqb4dzwJSxAI+hbusA0Oyo9T/DSNNdar0RIzJCD:zgwRucB4SxqbusAvnroYID
Score

8^/10

evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

behavioral2