ebff78c6e1f1831dca067f64f6e8fb9ee8947816e6baa8beee542399b92c5ef6 | Triage

Sharing

General

Target

30aa5126abda19531174323dff513c80_NEAS
Size

24KB
Sample

240506-3f9asagc7t
MD5

30aa5126abda19531174323dff513c80
SHA1

992ec6ca6dfbe8a92980e0a9e344ad089c4ded53
SHA256

ebff78c6e1f1831dca067f64f6e8fb9ee8947816e6baa8beee542399b92c5ef6
SHA512

f41e9f34834220a6e331a47eb35420a7b64e30630007e3ac15c5abf01246290e8dfe8a9a39f6bf3b1020ab37f98247fdd55766c1dad840f89b0f6c7afac95398
SSDEEP

384:+7ZfapsmVHgRK/rJ1OetA8gA49lBrenVyG+txHBtNsmSJJEFk2:OpgTARK/rRggVGhBRAEy2

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  30aa5126abda19531174323dff513c80_NEAS
- Size
  
  24KB
- MD5
  
  30aa5126abda19531174323dff513c80
- SHA1
  
  992ec6ca6dfbe8a92980e0a9e344ad089c4ded53
- SHA256
  
  ebff78c6e1f1831dca067f64f6e8fb9ee8947816e6baa8beee542399b92c5ef6
- SHA512
  
  f41e9f34834220a6e331a47eb35420a7b64e30630007e3ac15c5abf01246290e8dfe8a9a39f6bf3b1020ab37f98247fdd55766c1dad840f89b0f6c7afac95398
- SSDEEP
  
  384:+7ZfapsmVHgRK/rJ1OetA8gA49lBrenVyG+txHBtNsmSJJEFk2:OpgTARK/rRggVGhBRAEy2
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2