92a009b7c5d47c2b4af0d2074bef322bc787f4e7c69c7d59f9c2ae9c61973871 | Triage

Sharing

General

Target

92a009b7c5d47c2b4af0d2074bef322bc787f4e7c69c7d59f9c2ae9c61973871N
Size

25KB
Sample

240919-ferysasalp
MD5

615cab5d22d13838c62b8b4509225380
SHA1

7325d0a4854076f60b698fed4fec9be5345f0f8c
SHA256

92a009b7c5d47c2b4af0d2074bef322bc787f4e7c69c7d59f9c2ae9c61973871
SHA512

8e1fdeb39d083a7e38c6d2cbae933b9bfea806ccec7dabb4d40cd8d7ef2cc445f9d23a1e7b46d6e1bbd4f1bd3cfeecc4ea2c67ffb66b26b277ae26ac94e6553a
SSDEEP

768:N/ybgNcFXvtdgI2MyzNtRQtOflIwoHNV2XBFV72B4lA7Ps2Z+7s:AtdgI2MyzNtRQtOflIwoHNV2XBFV72BT

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  92a009b7c5d47c2b4af0d2074bef322bc787f4e7c69c7d59f9c2ae9c61973871N
- Size
  
  25KB
- MD5
  
  615cab5d22d13838c62b8b4509225380
- SHA1
  
  7325d0a4854076f60b698fed4fec9be5345f0f8c
- SHA256
  
  92a009b7c5d47c2b4af0d2074bef322bc787f4e7c69c7d59f9c2ae9c61973871
- SHA512
  
  8e1fdeb39d083a7e38c6d2cbae933b9bfea806ccec7dabb4d40cd8d7ef2cc445f9d23a1e7b46d6e1bbd4f1bd3cfeecc4ea2c67ffb66b26b277ae26ac94e6553a
- SSDEEP
  
  768:N/ybgNcFXvtdgI2MyzNtRQtOflIwoHNV2XBFV72B4lA7Ps2Z+7s:AtdgI2MyzNtRQtOflIwoHNV2XBFV72BT
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2