38f5c366044eceadb92f0b20cb7c2b37430b06ba6d2d7a9ff5ddd2b15e14a9e3 | Triage

Sharing

General

Target

38f5c366044eceadb92f0b20cb7c2b37430b06ba6d2d7a9ff5ddd2b15e14a9e3N
Size

455KB
Sample

241001-2bp6nsxcmc
MD5

21cb68dbbe8aec8fafa66cf78ba70640
SHA1

8e3dbe315872dbde85fa614ec15d53b0a3c9b81b
SHA256

38f5c366044eceadb92f0b20cb7c2b37430b06ba6d2d7a9ff5ddd2b15e14a9e3
SHA512

72e495337e001fec296acc9fa45377948f32ebf0bfb0481ec8aaf499a59a9a899da7698754279d07add0e4ace70f2ac2400c388f6887b9e6bb5b2ed2e17723bb
SSDEEP

6144:mBapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F8MLpIh9jil:5pQD+mO5KWy/zrVbt4fcY39U9jI

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  38f5c366044eceadb92f0b20cb7c2b37430b06ba6d2d7a9ff5ddd2b15e14a9e3N
- Size
  
  455KB
- MD5
  
  21cb68dbbe8aec8fafa66cf78ba70640
- SHA1
  
  8e3dbe315872dbde85fa614ec15d53b0a3c9b81b
- SHA256
  
  38f5c366044eceadb92f0b20cb7c2b37430b06ba6d2d7a9ff5ddd2b15e14a9e3
- SHA512
  
  72e495337e001fec296acc9fa45377948f32ebf0bfb0481ec8aaf499a59a9a899da7698754279d07add0e4ace70f2ac2400c388f6887b9e6bb5b2ed2e17723bb
- SSDEEP
  
  6144:mBapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F8MLpIh9jil:5pQD+mO5KWy/zrVbt4fcY39U9jI
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence