General

  • Target

    2024-05-22_a2b44b7dd908e1738eafdc99963eb0ee_snatch

  • Size

    8.6MB

  • Sample

    240522-yrm5gaed9w

  • MD5

    a2b44b7dd908e1738eafdc99963eb0ee

  • SHA1

    93e8ef51eec977c24d568e5679f1854f5a0f2826

  • SHA256

    cf02ea41a0d8ad023693c286aae1fc58ae87e5c643505089cdb608ef727b1f9f

  • SHA512

    9863f522d9280fa0ce5bb248da47af19fe06bca5332177d1f1ed30c2b504375c90beb6ef720d38a066975953ea6cb09e8dc316d7582307587d7047f68fbfb946

  • SSDEEP

    49152:z3F8rWbq4wkfYFBxz2i+M4DBYYg1nsqA0tOx0SlZIlq1tLCZRNE7ft8XFap99jqY:9cBQShnFA0Uliug0Ere07g/8XemW

Malware Config

Targets

    • Target

      2024-05-22_a2b44b7dd908e1738eafdc99963eb0ee_snatch

    • Size

      8.6MB

    • MD5

      a2b44b7dd908e1738eafdc99963eb0ee

    • SHA1

      93e8ef51eec977c24d568e5679f1854f5a0f2826

    • SHA256

      cf02ea41a0d8ad023693c286aae1fc58ae87e5c643505089cdb608ef727b1f9f

    • SHA512

      9863f522d9280fa0ce5bb248da47af19fe06bca5332177d1f1ed30c2b504375c90beb6ef720d38a066975953ea6cb09e8dc316d7582307587d7047f68fbfb946

    • SSDEEP

      49152:z3F8rWbq4wkfYFBxz2i+M4DBYYg1nsqA0tOx0SlZIlq1tLCZRNE7ft8XFap99jqY:9cBQShnFA0Uliug0Ere07g/8XemW

    • Downloads MZ/PE file

    • Sets file execution options in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Tasks