General
- Target e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
- Size 5.3MB
- Sample240417-plfc1aef75
- SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
Score
8/10
Malware Config
Targets
-
- Target e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
- Size 5.3MB
- SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
Score8/10-
Contacts a large (719) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1