92809683cfb72fe871304717aa1031f7c59a18356900aeb2015ad38e1e05e7e8 | Triage

Sharing

General

Target

8d1307a9e1186f89399e2251998f1494.zip
Size

7.3MB
Sample

240906-3xtawsthjr
MD5

19ef4b0e2b87525b73686b5a69ca4718
SHA1

26f0b572e090eb70d5f8720a6685504d31e2c698
SHA256

92809683cfb72fe871304717aa1031f7c59a18356900aeb2015ad38e1e05e7e8
SHA512

2b187e46a5579bd7d3720013fe1a74713bfd5b21d77df4eb319e085871390c74946aa7b1e69bde5cb1399cbc3979ea23d1a642057460829dc2703f62c96cc079
SSDEEP

196608:W0iXzrdh5sGzkBN8Fz05aQD4+qOXtb6rQtsiJYT2L:W0K1+N8gDEWmWsq

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  d3a4be43fda6285a85ff94fa62f8daea60ef31ca27384ecbb35a2793e3214ef7
- Size
  
  7.9MB
- MD5
  
  8d1307a9e1186f89399e2251998f1494
- SHA1
  
  d2614c64b38c812e1ceafdac6b5527b21dc4c6c3
- SHA256
  
  d3a4be43fda6285a85ff94fa62f8daea60ef31ca27384ecbb35a2793e3214ef7
- SHA512
  
  496f235c39695b88358c96891fc61ca0440130dd9cfecdbc68d8c2747c9cdfac8b3d2542c49df82d01b3192ce04d5e343584df711e0049626f2c2028c78241b2
- SSDEEP
  
  196608:8Eazg7DSmEazg7DSmEazg7DSmEazg7DSN:Og7uYg7uYg7uYg7uN
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence