ecaaee38e18ca216ae60a0af4098dc5aabccca516b2321cffdf3d038c88cc2e2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ecaaee38e18ca216ae60a0af4098dc5aabccca516b2321cffdf3d038c88cc2e2
Size

44KB
Sample

240912-dekhlaxflq
MD5

7d13b7a8bcd35906e96c3e3e6b561536
SHA1

89071f9b48238de3889b2115ccd64d4b3550e00d
SHA256

ecaaee38e18ca216ae60a0af4098dc5aabccca516b2321cffdf3d038c88cc2e2
SHA512

016782e4c15305039566645b63c105078627e6ae096a3ddc21aae01dc5ef96d8924fd51d12b64698a6c88d176ff8633220250d7d40c311e180d7e1d3940e572e
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAwwf:b/pYayGig5HjS3NPAdf

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  ecaaee38e18ca216ae60a0af4098dc5aabccca516b2321cffdf3d038c88cc2e2
- Size
  
  44KB
- MD5
  
  7d13b7a8bcd35906e96c3e3e6b561536
- SHA1
  
  89071f9b48238de3889b2115ccd64d4b3550e00d
- SHA256
  
  ecaaee38e18ca216ae60a0af4098dc5aabccca516b2321cffdf3d038c88cc2e2
- SHA512
  
  016782e4c15305039566645b63c105078627e6ae096a3ddc21aae01dc5ef96d8924fd51d12b64698a6c88d176ff8633220250d7d40c311e180d7e1d3940e572e
- SSDEEP
  
  768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAwwf:b/pYayGig5HjS3NPAdf
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2