541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04c | Triage

Sharing

General

Target

541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN
Size

5.9MB
Sample

241004-d5sa5asdjq
MD5

d5cf63bd40ee7264411d869b1e0dedc0
SHA1

5ff886581eb6772a93a066b1c66916b58f2d0f8f
SHA256

541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04c
SHA512

97e5ec0dc6a598b675990b4c84e32438e4636fc204f1954d3fd188399c1a6404bf53c41d5061baa898be17ce76a26c3326251450c5be86726a939a87297bb86c
SSDEEP

98304:oKgKdd/yzt67OU7apwKgKdd/yzt67OU7apwKgKdd/yzt67OU7apv:0Cazg7DS8Cazg7DS8Cazg7DSv

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN
- Size
  
  5.9MB
- MD5
  
  d5cf63bd40ee7264411d869b1e0dedc0
- SHA1
  
  5ff886581eb6772a93a066b1c66916b58f2d0f8f
- SHA256
  
  541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04c
- SHA512
  
  97e5ec0dc6a598b675990b4c84e32438e4636fc204f1954d3fd188399c1a6404bf53c41d5061baa898be17ce76a26c3326251450c5be86726a939a87297bb86c
- SSDEEP
  
  98304:oKgKdd/yzt67OU7apwKgKdd/yzt67OU7apwKgKdd/yzt67OU7apv:0Cazg7DS8Cazg7DS8Cazg7DSv
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence