004e428c346030c60c78b3491338fdd8bc7b99f99635aa499d938cddadab7fc9 | Triage

Sharing

General

Target

004e428c346030c60c78b3491338fdd8bc7b99f99635aa499d938cddadab7fc9.exe
Size

16.7MB
Sample

240511-khqmcahc8t
MD5

95725d0f470b040407ad7c70e9207712
SHA1

938dde17627a2d42a8eaf0e0e8a5e77bfb581bf0
SHA256

004e428c346030c60c78b3491338fdd8bc7b99f99635aa499d938cddadab7fc9
SHA512

b867c6ab459940cdfa58a50c09c7dfc2e54b91787ce06831c60e14d1de4581956f518716116656fb1a5400891c98e1c47debc54ed39f5411020f4087bf85ed36
SSDEEP

393216:Tr4i1cGQlxPfhAqxtx1iRpmtfySN+82/br3yq6G8P7ie0M:gUihAqzPUmtfL+fn6pP+z

Score

8^/10

discovery execution persistence

Malware Config

Targets

- Target
  
  004e428c346030c60c78b3491338fdd8bc7b99f99635aa499d938cddadab7fc9.exe
- Size
  
  16.7MB
- MD5
  
  95725d0f470b040407ad7c70e9207712
- SHA1
  
  938dde17627a2d42a8eaf0e0e8a5e77bfb581bf0
- SHA256
  
  004e428c346030c60c78b3491338fdd8bc7b99f99635aa499d938cddadab7fc9
- SHA512
  
  b867c6ab459940cdfa58a50c09c7dfc2e54b91787ce06831c60e14d1de4581956f518716116656fb1a5400891c98e1c47debc54ed39f5411020f4087bf85ed36
- SSDEEP
  
  393216:Tr4i1cGQlxPfhAqxtx1iRpmtfySN+82/br3yq6G8P7ie0M:gUihAqzPUmtfL+fn6pP+z
Score

8^/10

discovery execution persistence
- Creates new service(s)
  persistence execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecutionpersistence

behavioral2

discoveryexecutionpersistence