f98c9bd918a9bd8e5027854c75c520309204a2e14fb40c9fd08d4ef8a6883263 | Triage

Sharing

General

Target

ba7445dd6438c2097c1c5b2ce173c064.bin
Size

2.3MB
Sample

240417-cae7msbh9w
MD5

eb69814520bc06926c51925b5ae21590
SHA1

82ae6bfcd414dd79fd9dabe6f628eb646a4ed956
SHA256

f98c9bd918a9bd8e5027854c75c520309204a2e14fb40c9fd08d4ef8a6883263
SHA512

555c7892241ccc710faa7a11fb8d84fc736ac0aa2155df866c1809504098c19477d00720f7d0c4a56da46c3aee490ceb4241f931a17724e2d404610fa52279f4
SSDEEP

49152:sojeWkOoBtHLiCuwQ53Zqp9vGLM5EDV++gjhnit9r58a1Uo:tit16FZqPvp5s0+DF580l

Score

8^/10

evasion

Malware Config

Targets

- Target
  
  4cd8586d09ba9e97b4e50bb2d9d1e671a50bfe79bcd29ebf851ae6defc8d1768.exe
- Size
  
  2.4MB
- MD5
  
  ba7445dd6438c2097c1c5b2ce173c064
- SHA1
  
  24873c5c09152806caa71b6bb990ef0797e626ae
- SHA256
  
  4cd8586d09ba9e97b4e50bb2d9d1e671a50bfe79bcd29ebf851ae6defc8d1768
- SHA512
  
  6cf7d18b51d2ec88d9c76470800cf9b8c1fcb30fe02041be3f3694eb7e2a708a9d96ed7b9aafd5e7fdff5b618d6b1796a80c78c74204e7272b58a7b4f7a84ace
- SSDEEP
  
  49152:zgwRBNhWLwbYdMsr37tl5oaSeaduub9vdcOMigvOQowQEJHQJPT5NuEj3uWNtiT:zgwRBNhmwbirt02q1r4PFJwJ1fjeWNk
Score

8^/10

evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

behavioral2