54eb180e8eaa667b82be723066f29b14456b00d8a69c100d56f9a530398fba85 | Triage

Sharing

General

Target

54eb180e8eaa667b82be723066f29b14456b00d8a69c100d56f9a530398fba85
Size

635KB
Sample

240928-ykm6wswflg
MD5

bfd012c5ae9040bdc2c112884595101b
SHA1

c76b34ef2786272260efd531deb8f64dca040a32
SHA256

54eb180e8eaa667b82be723066f29b14456b00d8a69c100d56f9a530398fba85
SHA512

3760f43b7074cd237c8e90084796a599579e2ae0e74a9dd534ac072b94c7b67721b5efc013677cd13c9b987afbb246c814841d35905b83889399b5f4efdc3619
SSDEEP

6144:fBDHmrz4niNy8o3Zp/TWt+g4RQTDUBO8/2vh+ziDV8m56TBac2GuP:5DHmoniNy8L8g4RgoBO8/2vhDX56TY

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  54eb180e8eaa667b82be723066f29b14456b00d8a69c100d56f9a530398fba85
- Size
  
  635KB
- MD5
  
  bfd012c5ae9040bdc2c112884595101b
- SHA1
  
  c76b34ef2786272260efd531deb8f64dca040a32
- SHA256
  
  54eb180e8eaa667b82be723066f29b14456b00d8a69c100d56f9a530398fba85
- SHA512
  
  3760f43b7074cd237c8e90084796a599579e2ae0e74a9dd534ac072b94c7b67721b5efc013677cd13c9b987afbb246c814841d35905b83889399b5f4efdc3619
- SSDEEP
  
  6144:fBDHmrz4niNy8o3Zp/TWt+g4RQTDUBO8/2vh+ziDV8m56TBac2GuP:5DHmoniNy8L8g4RgoBO8/2vhDX56TY
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence