76726892a038b6450ebebc174d82fae2cb1c2563fd74ae789e359704d3a89737 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17038cd8d20b5e9476d3b5ccdc811943.zip
Size

7.3MB
Sample

240901-qwcwassbkk
MD5

6bad1ed1972c50c535f5f426067079b7
SHA1

3c2686552073003c3390509abb233a7beb73bb4e
SHA256

76726892a038b6450ebebc174d82fae2cb1c2563fd74ae789e359704d3a89737
SHA512

0fc3730ad653d06bd81e79d4836e9a274919ec7b3d1d15cd90c64943c9152f6b76861c7910e30f1797f00701cf136a84acc232bb934845c0810c7e51677c28f3
SSDEEP

196608:BR4ggLQfjR9WrGLpOXp3tF7o814jIwxTIVmUUGPw:5g6FuLFsYkIwxTKmpf

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  036f73e214d100c8f78a0ac912acf10690e3576207ad1f994b7cfadd05b63c34
- Size
  
  7.9MB
- MD5
  
  17038cd8d20b5e9476d3b5ccdc811943
- SHA1
  
  f2e6ab5181639cb274829be2c495d3ab59756ca8
- SHA256
  
  036f73e214d100c8f78a0ac912acf10690e3576207ad1f994b7cfadd05b63c34
- SHA512
  
  67e57f890d1648c0558e58c1abc180812a89d00c8b4ed2b728a25701dafb3dd9ae555873d132d106372edaaacc680d6d1f66df62270c3bdc4cbcbd18c1f51395
- SSDEEP
  
  196608:8lazg7DSmlazg7DSmlazg7DSmlazg7DSN:9g7uHg7uHg7uHg7uN
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence