9e00bc44f5d68e5a30bd319e9503f29a6c0a4d4629a1cd8ddabe0deac803adf7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9e00bc44f5d68e5a30bd319e9503f29a6c0a4d4629a1cd8ddabe0deac803adf7
Size

783KB
Sample

241003-xv4e7avhkb
MD5

0e219d6c5208f95fd62b8fd7448bfeb3
SHA1

d620a5836dd34eb16d0ae99d882a10d15f3b4f16
SHA256

9e00bc44f5d68e5a30bd319e9503f29a6c0a4d4629a1cd8ddabe0deac803adf7
SHA512

6717b0c2bd9ed907c736b9b9700beaae083702a3fca3ac178b174df64e35dc55f510f4603e75de1485cb7237145970b3a875a595c678f51be3528abf088e8230
SSDEEP

12288:C761wOyrC4dtJHekiIPlHB1GzVoFB6UCBmdquf0qyoOCJUp+1EwOjo4snLM9TxBu:C7M1iJHJT1DGh9idqu8HoHUp+JUsLau

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  9e00bc44f5d68e5a30bd319e9503f29a6c0a4d4629a1cd8ddabe0deac803adf7
- Size
  
  783KB
- MD5
  
  0e219d6c5208f95fd62b8fd7448bfeb3
- SHA1
  
  d620a5836dd34eb16d0ae99d882a10d15f3b4f16
- SHA256
  
  9e00bc44f5d68e5a30bd319e9503f29a6c0a4d4629a1cd8ddabe0deac803adf7
- SHA512
  
  6717b0c2bd9ed907c736b9b9700beaae083702a3fca3ac178b174df64e35dc55f510f4603e75de1485cb7237145970b3a875a595c678f51be3528abf088e8230
- SSDEEP
  
  12288:C761wOyrC4dtJHekiIPlHB1GzVoFB6UCBmdquf0qyoOCJUp+1EwOjo4snLM9TxBu:C7M1iJHJT1DGh9idqu8HoHUp+JUsLau
Score

8^/10

discovery persistence
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence